The vulnerability is located in the sigstore-go library used for signing and verification. Before version 1.2.0, a verifier that is configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counted witnesses per verified entry rather than per distinct log authority. That counting flaw allows a single compromised transparency log or CT log to satisfy a multi‑log threshold requirement, enabling an attacker to present a malicious signature that the verifier would incorrectly accept. The result is a loss of integrity in the verification process, which could permit tampered artifacts to be considered trustworthy. The flaw corresponds to CWE-347.

Any software or container that incorporates sigstore-go and uses the WithTransparencyLog or WithSignedCertificateTimestamps options with a threshold greater than one is affected. All releases of sigstore-go older than v1.2.0 meet that condition. The issue is resolved in version 1.2.0 and later.

The CVSS score of 5.9 indicates moderate impact on integrity. The EPSS score, less than 1 %, reflects a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to provide a malicious log entry that passes the single compromised log, thereby satisfying the multi‑log threshold. Successful exploitation would let an attacker forge signatures and bypass integrity checks in systems that rely on sigstore-go for artifact validation.