Insufficient Verification of Data Authenticity Affecting stigmem-node package, versions [,0.9.0a2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-STIGMEMNODE-17661123
- published28 Jun 2026
- disclosed29 May 2026
- creditUnknown
Introduced: 29 May 2026
CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade stigmem-node to version 0.9.0a2 or higher.
Overview
stigmem-node is a Stigmem reference node — single-host production implementation
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to improper validation in the peer-token timestamp process. An attacker can cause valid authentication tokens to be rejected by presenting tokens with timestamps that are incorrectly interpreted as expired, leading to disruption of authenticated federation flows and potential denial of service.
Workaround
This vulnerability can be mitigated by avoiding mixed peer-token minting paths and restricting federation use to tightly controlled peers.