Insufficient Verification of Data Authenticity Affecting stigmem-node package, versions [,0.9.0a2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-STIGMEMNODE-17661125
- published28 Jun 2026
- disclosed29 May 2026
- creditUnknown
Introduced: 29 May 2026
CVE NOT AVAILABLE CWE-295 (opens in a new tab)How to fix?
Upgrade stigmem-node to version 0.9.0a2 or higher.
Overview
stigmem-node is a Stigmem reference node — single-host production implementation
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the peer registration process. An attacker can impersonate a federation peer or intercept registration by submitting malicious key material without requiring explicit administrator approval or out-of-band fingerprint verification. This is only exploitable if federation peer registration is exposed to untrusted networks and administrator approval is not enforced.
Workaround
This vulnerability can be mitigated by restricting peer registration endpoints to trusted administrative networks and verifying peer public-key fingerprints out of band before allowing federation traffic.