Bouncy Castle Java CVE-2026-71891

Exploitation requires the target application to construct an ECPoint on an explicit, non-canonical ECCurve (e.g. via ECCurve.Fp#createPoint) that shares BLS12-381's field characteristic, and to accept that caller-supplied point as an authority-bearing public key passed to BLS12_381BasicScheme.keyValidate / BLSPublicKeyParameters (and any BasicScheme, MessageAugmentation, or ProofOfPossession verify/aggregateVerify built on it). The attacker forges the foreign curve's cofactor to 1 so ECPoint.satisfiesOrder returns true without a real subgroup check. The decisive LIMITING factor: the standard 48-byte compressed-point decoder always supplies the canonical G1 curve and is NOT vulnerable, so applications that only decode compressed points are unaffected; only non-default explicit-curve key handling is reachable. Affected versions are Bouncy Castle for Java before 1.86.

This is a genuine cryptographic authentication-bypass (CWE-347) but a conditional one, not a mass-exploitation event. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, VI:H only) scores 7.1 and correctly reflects that the only impact is integrity - a forged/phantom signer accepted in an aggregate BLS12-381 signature - with no confidentiality (VC:N) or availability (VA:N) impact. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is no signal of active or widespread exploitation; the only exploitation artifact is a demonstration unit test shipped inside the fix commit. The dominant risk-limiting signal is not in the CVSS metrics at all: the vendor explicitly states the flaw is reachable ONLY where an application constructs an ECPoint on an explicit, non-canonical curve and treats it as an authority-bearing key - the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected. That caveat makes the effective attack surface far narrower than AV:N/PR:N/AC:L alone suggests. Net: a real, patch-worthy correctness defect for the specific population of applications that parse caller-supplied explicit-curve public keys into BLS verification, but a low-urgency item for the typical deployment that only ever decodes canonical compressed points.

An attacker crafts a 'public key' as an ECPoint on a foreign elliptic curve that merely shares BLS12-381's field characteristic, with the curve's cofactor forged to 1 so the prime-order subgroup check passes trivially. The attacker submits this point as one of the public keys in a set used for aggregate signature verification; because the forged point contributes the identity in the target group, the verifier accepts the aggregate as valid even though no signature for that key/message pair was ever produced, inserting a phantom signer. No public weaponized exploit was supplied, though the vendor fix commit includes a unit test demonstrating the rejection of exactly such a point.