CVE-2026-16001

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description In the stream mode of IesEngine (when constructed without a block cipher), the message authentication key is exposed through the encryption keystream. A remote attacker who has observed one encrypted message with known plaintext can forge shorter messages that the recipient accepts as authentic by using a crafted ciphertext and MAC tag. This occurs because the MAC key is derived from the output directly after a keystream as long as the message, while the derivation input depends only on the static key pair and fixed parameters. Consequently, the keystream revealed by a single message contains the MAC key for all sufficiently shorter messages.

Recommendations Update bc-csharp to version 2.7.0 or later.