CPE
The sigstore-js library prior to 0.7.2 fails to validate OCI registry redirect origins in RegistryClient.uploadBlob(), allowing compromised registries to perform unauthorized exfiltration of authentication headers to attacker-controlled hosts.