Bug 2499686 (CVE-2026-48758) - CVE-2026-48758 sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding
Summary: CVE-2026-48758 sigstore-core: @sigstore/core: Signature bypass due to incorre...
Keywords:
Status: NEW
Alias: CVE-2026-48758
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-13 14:40 UTC by OSIDB Bzimport
Modified: 2026-07-16 11:56 UTC (History)
30 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-13 14:40:03 UTC 
The preAuthEncoding function in @sigstore/core uses Node.js 'ascii' encoding when converting the PAE string to bytes. This allows payloadType to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide. An attacker can substitute characters in payloadType with Unicode variants whose low byte matches, producing identical PAE bytes and passing signature verification. Fixed in @sigstore/core 3.2.1.
Note You need to log in before you can comment on or make changes to this bug.