CVE-2026-71891

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86

Description An issue exists in the BLS12 381BasicScheme.keyValidate function, affecting BLSPublicKeyParameters and the verify and aggregateVerify methods of BasicScheme, MessageAugmentation, and ProofOfPossession. The system accepts public keys built on a foreign ECCurve that shares the field characteristic of BLS12-381. Because the prime-order subgroup check relies on the point's own curve to define its cofactor, a point on a curve with a different equation and a forged cofactor of one can bypass keyValidate without being a valid G1 point. In the pairing implementation, such a point contributes the identity in the target group, allowing an aggregate signature to be accepted even if it lacks a signature for that specific key and message pair, effectively permitting a phantom signer. This is only reachable if an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key.

Recommendations Update Bouncy Castle for Java to version 1.86 or later.