CVE-2026-63571

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Improper verification of cryptographic signatures in the attribute certificate path validator PkixAttrCertPathValidator (also used by PkixAttrCertPathBuilder) allows a remote attacker to have a forged X.509 attribute certificate accepted as valid. This occurs because the RFC 3281 validation steps verify the holder and issuer certification paths, validity period, extensions, and revocation status, but fail to verify the attribute certificate's signature using the issuer's public key. An attacker can exploit this by using an attribute certificate that names a trusted attribute authority as its issuer without actually being signed by it, potentially gaining roles or privileges granted by the application based on those attributes. Only applications utilizing these specific classes to validate attribute certificates are affected.

Recommendations Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, restrict the use of the PkixAttrCertPathValidator and PkixAttrCertPathBuilder classes for validating attribute certificates.