The vulnerability in sigstore timestamp-authority versions prior to 2.0.6 involves improper certificate validation (CWE-295) in the VerifyTimestampResponse function. While the certificate chain signature is verified correctly, the TSA-specific constraint checks are applied to the first non-CA certificate in the PKCS#7 certificate bag rather than the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag, causing the system to validate the signature against an authorized certificate but perform authorization checks against a different, potentially malicious certificate. This leads to an authorization bypass in the verification package but does not affect the timestamp-authority service itself or sigstore-go. The vulnerability is fixed in version 2.0.6.

An attacker can bypass authorization checks in the verification process by exploiting the certificate validation flaw, potentially allowing unauthorized actions related to timestamp verification. There is no impact on confidentiality or availability, and the vulnerability does not affect the timestamp-authority service or sigstore-go. The CVSS score of 5.5 reflects a medium impact primarily on integrity.

Upgrade to sigstore timestamp-authority version 2.0.6 or later, where this vulnerability is fixed. Since the issue affects only the verification package and not the service itself, users relying on this package should update accordingly. Patch status is confirmed fixed in version 2.0.6.