stigmem-node version 0.9.0a1 allows an attacker to register a malicious federation peer because the application accepts federation peer key material without requiring an out‑of‑band administrator fingerprint verification step. This authentication bypass can be exploited by an adversary who controls or can intercept the initial registration traffic, enabling unauthorized peers to join the federation. Once registered, the attacker can read, modify, or delete federation traffic, compromising confidentiality, integrity, and continuity of federation communication.

Vendors: Eidetic Labs’ stigmem. Affected product: stigmem-node. The vulnerability exists in release 0.9.0a1. The issue is resolved starting in 0.9.0a2, which introduces a pending approval flow that requires administrator fingerprint verification before accepting peer tokens.

CVSS score 9.1 indicates critical severity. EPSS score is not available; no listing in CISA KEV implies no public exploit campaigns are known yet. However, the vulnerability can be exploited remotely over the network during federation peer registration, requiring only the ability to send the registration request. Because the application lacks protected registration, the likelihood of exploitation in an open network is high. The absence of a blocked or mitigated entry in KEV and the lack of an EPSS indicator does not reduce the risk; organizations should consider any future discovery of active exploitation as a significant threat.