CVE-2026-76245: Insufficient Verification of Data Authenticity in eidetic-labs stigmem
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.
AI Analysis
Technical Summary
The vulnerability in stigmem (pip package stigmem-node) version 0.9.0a1 arises from a timestamp-handling mismatch in the federation peer-token validation process. This mismatch can lead to valid peer tokens being mistakenly considered expired, which affects the availability and reliability of federation authentication flows on nodes using federation peer authentication. The problem is addressed in version 0.9.0a2, which implements a canonical millisecond-based validation path to correctly verify token timestamps.
Potential Impact
This vulnerability impacts the availability and reliability of authenticated federation flows by causing valid peer tokens to be rejected as expired. This can disrupt federation peer authentication paths, potentially leading to denial of service or authentication failures in distributed systems relying on stigmem for federation.
Mitigation Recommendations
A fix is available in stigmem version 0.9.0a2, which corrects the timestamp validation logic. Users should upgrade to version 0.9.0a2 or later to resolve this issue. Patch status is not explicitly confirmed beyond this version update; check the vendor advisory for the latest remediation guidance.
CVE-2026-76245: Insufficient Verification of Data Authenticity in eidetic-labs stigmem
Description
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.
CVSS v4.0
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in stigmem (pip package stigmem-node) version 0.9.0a1 arises from a timestamp-handling mismatch in the federation peer-token validation process. This mismatch can lead to valid peer tokens being mistakenly considered expired, which affects the availability and reliability of federation authentication flows on nodes using federation peer authentication. The problem is addressed in version 0.9.0a2, which implements a canonical millisecond-based validation path to correctly verify token timestamps.
Potential Impact
This vulnerability impacts the availability and reliability of authenticated federation flows by causing valid peer tokens to be rejected as expired. This can disrupt federation peer authentication paths, potentially leading to denial of service or authentication failures in distributed systems relying on stigmem for federation.
Mitigation Recommendations
A fix is available in stigmem version 0.9.0a2, which corrects the timestamp validation logic. Users should upgrade to version 0.9.0a2 or later to resolve this issue. Patch status is not explicitly confirmed beyond this version update; check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-19T11:38:33.225Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85bc80acd9273b492f4a3c
Added to database: 08/19/2026, 14:24:00 UTC
Last enriched: 08/19/2026, 14:37:05 UTC
Last updated: 08/20/2026, 01:41:32 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.