Tagged articles

signature malleability

2 articles · Page 1 of 1

Jul 15, 2026 · Information Security

GitHub Verified Badge Is Malleable: Identical Code, Multiple Valid Commit Hashes

A Carnegie Mellon PhD student uncovered a fundamental flaw in GitHub's "Verified" badge that lets an attacker, without the signing key, generate a second commit with the same tree, timestamp and a valid signature but a different hash, compromising any system that treats the commit hash as an immutable identifier.

GitGitHubVerified badge

0 likes · 8 min read

GitHub Verified Badge Is Malleable: Identical Code, Multiple Valid Commit Hashes

Black & White Path

Jul 11, 2026 · Information Security

GitHub Verified Badge Malleable: Same Code Yields Multiple Valid Commit Hashes

Jacob Ginesin of Carnegie Mellon discovered that GitHub’s “Verified” badge can be forged through signature malleability, allowing an attacker to create a second commit with identical tree and timestamp but a different hash, breaking the assumption that commit hashes are immutable identifiers for many downstream systems.

GitGitHubVerified badge

0 likes · 8 min read