CVE-2026-48758

A flaw was found in the @sigstore/core component. The preAuthEncoding function incorrectly uses Node.js 'ascii' encoding when converting Pre-Authentication Encoding (PAE) strings to bytes. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE).

A flaw was found in @sigstore/core. The preAuthEncoding function uses Node.js ASCII encoding which truncates Unicode characters to their low byte, allowing payloadType to be mutated after signing without invalidating the DSSE signature.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to @sigstore/core 3.2.1 or later.