AIKIDO-2026-10706

TL;DR

The Base64 string validator treated inputs according to decoding behavior where ASCII whitespace could be ignored before decoding, so strings containing whitespace could still be accepted as valid Base64 even when they should be rejected under strict Base64 rules. That weakens the guarantee that passing validation implies a canonical strict Base64 payload. The implementation now rejects whitespace so invalid Base64 inputs are not normalized into passing values.