Bouncy Castle C# EUVD-2026-91222

Exploitation requires that the target application uses bc-csharp's PkixAttrCertPathValidator or PkixAttrCertPathBuilder to validate X.509 attribute certificates and makes authorization/role decisions based on the attributes in those certificates - this is the exact precondition, not a generic one. Within such applications the attack is remote and unauthenticated (PR:N): the attacker only needs to supply a forged AC that references a trusted attribute authority as issuer, since the signature is never checked. The practical limiting factor is that attribute-certificate validation is an uncommon deployment feature, so applications that only validate standard public-key X.509 certificates, or that do not grant privileges from attribute certificates, are not affected; upgrading bc-csharp to 2.7.0 eliminates the flaw.

This is a genuine high-severity authentication/authorization-bypass flaw, not a CVSS-inflated non-issue, but its real-world blast radius is narrowed by a specific usage precondition. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with high integrity impact (VI:H) and no confidentiality or availability impact (VC:N/VA:N) - consistent with CWE-347 (improper signature verification) and the commit evidence showing the signature was never checked against the issuer's public key. The flaw is high-confidence (vendor-confirmed via the bc-csharp wiki advisory and a concrete patch commit that adds ProcessAttrCert2B to call attrCert.IsSignatureValid). No EPSS score, KEV listing, or POC was provided, so exploitation likelihood signals are absent - no public exploit identified at time of analysis, and there is no evidence of active exploitation. The key limiting factor overriding the raw 'network/unauthenticated' reading is that only applications using PkixAttrCertPathValidator/PkixAttrCertPathBuilder to validate X.509 attribute certificates are affected; attribute certificates are a niche feature, so broad opportunistic exploitation is unlikely despite the high CVSS. Note the 'Information Disclosure' framing conflicts with the CVSS vector, which shows VC:N (no confidentiality impact) - the true impact is integrity/privilege-granting, so treat this as an authorization-bypass issue rather than data disclosure.

An attacker crafts a forged X.509 attribute certificate that names a trusted attribute authority as its issuer but is self-signed or signed with an attacker key, then presents it to a .NET application that uses bc-csharp's PkixAttrCertPathValidator to authorize actions. Because the validator checks holder/issuer paths, validity, extensions and revocation but never verifies the AC signature, the forged certificate is accepted and the attacker is granted whatever roles or privileges the application derives from the certificate's attributes. No public exploit code was provided, but the flaw is trivially exploitable given the straightforward signature-forgery requirement.