The vulnerability in sigstore-go originates from a missing check that compares the bundle signing timestamp against the validity window of an ExpiringKey. An attacker who possesses expired key material can use it to sign bundles that the library will accept as valid, thereby allowing tampered or malicious artifacts to be authenticated as legitimate. This bypass of signature validity compromises the integrity and authenticity of any system that relies on sigstore-go for verifying signed artifacts.

The affected product is sigstore-go, a Go library for Sigstore signing and verification, provided by sigstore. All versions prior to 1.2.1 are vulnerable. The flaw was addressed in release 1.2.1.

CVSS score of 3.1 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. It is not listed in the CISA KEV catalog. The flaw could be exploited when an attacker supplies malicious bundles to a system using sigstore-go, because the library will accept them without verifying key lifetime. Successful exploitation would enable an attacker to introduce compromised artifacts into the build or deployment pipeline. The likely attack vector is the supply chain where an attacker injects signed bundles into clients that use sigstore-go for verification.