Bug 2499686 (CVE-2026-48758)

Summary: CVE-2026-48758 sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, bbrownin, dfreiber, drow, dschmidt, ehelms, ggainey, jburrell, jlanda, jpasqual, juwatts, kshier, mhulan, mstipich, nmoumoul, osousa, pcreech, rchan, rexwhite, rhel-process-autobot, sdawley, simaishi, smallamp, stcannon, sthirugn, teagle, tmalecek, vkumar, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the @sigstore/core component. The preAuthEncoding function incorrectly uses Node.js 'ascii' encoding when converting Pre-Authentication Encoding (PAE) strings to bytes. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 14:40:03 UTC 
The preAuthEncoding function in @sigstore/core uses Node.js 'ascii' encoding when converting the PAE string to bytes. This allows payloadType to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide. An attacker can substitute characters in payloadType with Unicode variants whose low byte matches, producing identical PAE bytes and passing signature verification. Fixed in @sigstore/core 3.2.1.