CVE-2026-76245: stigmem Federation Peer Token Timestamp Validation Bypass
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stigmem-node (pip package stigmem-node)to a version that resolves this vulnerability.Fixed in 0.9.0a2 - Compensating control
Use the canonical millisecond-based validation path for federation peer-token timestamp validation on affected nodes to avoid the federation peer-token validation timestamp-handling mismatch present in stigmem-node version 0.9.0a1.
Event History
Frequently Asked Questions
Which deployments are affected?
Nodes running stigmem-node 0.9.0a1 that use federation peer authentication paths are affected. The described impact is on authenticated federation flow availability and reliability.
What causes the failure in federation authentication?
A timestamp-handling mismatch in peer-token validation can cause valid peer tokens to be treated as expired. The corrected release uses a canonical millisecond-based validation path.
What should be done to remediate the issue?
Upgrade to stigmem-node 0.9.0a2, which fixes the timestamp validation behavior.