The federated peer‑token validation in the stigmem pip package stumbles over a timestamp handling mismatch, which causes valid peer tokens to be incorrectly regarded as expired. The flaw lies in the comparison logic that does not use the canonical millisecond‑based clock reference, leading to unintended denial of authenticated federation flows. This results in loss of service availability and undermines the reliability of nodes that rely on federation peer authentication paths.

The issue affects only stigmem-node version 0.9.0a1 from the vendor eidetic‑labs. No other versions are listed as impacted. The vulnerability specifically targets the federation peer authentication routes inside that package.

With a CVSS score of 7.1, the vulnerability presents a moderate‑to‑high severity risk, particularly for deployments that depend on seamless peer‑to‑peer federation. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly reported exploits yet. Nonetheless, any network actor that can influence the peer‑token or trigger its validation can effectively deny service by forcing valid tokens to be rejected. The attack vector is inferred to be via the federation channel where token exchange occurs, as the flaw lies within the token validation routine used during that flow.