Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-26T19:11:19 sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CWE-347

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.

A flaw was found in the @sigstore/core component. The preAuthEncoding function incorrectly uses Node.js 'ascii' encoding when converting Pre-Authentication Encoding (PAE) strings to bytes. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE).

A flaw was found in @sigstore/core. The preAuthEncoding function uses Node.js ASCII encoding which truncates Unicode characters to their low byte, allowing payloadType to be mutated after signing without invalidating the DSSE signature. Upgrade to @sigstore/core 3.2.1 or later. Red Hat Enterprise Linux 10 Fix deferred sigstore Red Hat Enterprise Linux 8 Fix deferred sigstore Red Hat Enterprise Linux 9 Fix deferred sigstore Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred sigstore Red Hat OpenShift Dev Spaces Fix deferred sigstore Red Hat Satellite 6 Fix deferred sigstore Self-service automation portal 2 Fix deferred sigstore https://www.cve.org/CVERecord?id=CVE-2026-48758 https://nvd.nist.gov/vuln/detail/CVE-2026-48758 https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c