PT-2026-64220

Summary SignedDataVerifier attempts to perform online revocation checking when enable online checks=True, but its OCSP validation logic accepts stale GOOD responses as valid indefinitely. In appstoreserverlibrary/signed data verifier.py, ChainVerifier.check ocsp status verifies the OCSP response...