Bitcoin Core Patches PSBT Vulnerability That Allowed Stealth Payment Redirection

Bitcoin Core merged a safeguard into its master development branch on Sept. 25 to fix a flaw in partially signed Bitcoin transactions. The vulnerability, tied to the SIGHASH_SINGLE signing mode, allows a signature to remain valid even if the payment destination is changed. The flaw doesn't expose a user's private key, but it breaks the cryptographic guarantee that an approved recipient remains unchanged. For legacy inputs, missing outputs can produce a signature over a fixed hash value that is reusable against other unspent outputs controlled by the same key. As of Oct. 4, the project’s published release listings haven't identified a fixed version or confirmed backport for users.