diff --git a/tests/test_api.py b/tests/test_api.py
index e156d6b332..294ee3926f 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -1120,6 +1120,12 @@ def test_is_delegated_role_in_succinct_roles(self) -> None:
             "bin-0t",
             "bin-20",
             "bin-100",
+            # int(x, 16) accepts these, but they are not bin names
+            "bin-+f",
+            "bin- f",
+            "bin-f ",
+            "bin-0F",
+            "bin-1F",
         ]
         for role_name in false_role_name_examples:
             msg = f"Error for {role_name}"
@@ -1131,6 +1137,11 @@ def test_is_delegated_role_in_succinct_roles(self) -> None:
             msg = f"Error for {role_name}"
             self.assertTrue(succinct_roles.is_delegated_role(role_name), msg)
 
+        # int(x, 16) ignores underscores between digits
+        succinct_roles = SuccinctRoles([], 1, 12, "bin")
+        self.assertFalse(succinct_roles.is_delegated_role("bin-1_0"))
+        self.assertTrue(succinct_roles.is_delegated_role("bin-010"))
+
     def test_get_roles_in_succinct_roles(self) -> None:
         succinct_roles = SuccinctRoles([], 1, 16, "bin")
         # bin names are in hex format and 4 hex digits are enough to represent
diff --git a/tuf/api/_payload.py b/tuf/api/_payload.py
index 7b63cf5e01..582f5627ab 100644
--- a/tuf/api/_payload.py
+++ b/tuf/api/_payload.py
@@ -1385,6 +1385,11 @@ def is_delegated_role(self, role_name: str) -> bool:
         except ValueError:
             return False
 
+        # int() also accepts a sign, surrounding whitespace, underscores and
+        # upper case digits: only accept the exact name get_roles() produces
+        if suffix != f"{num:0{self.suffix_len}x}":
+            return False
+
         return 0 <= num < self.number_of_bins