CVE-2026-71891

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a point contributes the identity in the target group, so an aggregate signature verified against a set of public keys including it is accepted even though it contains no signature for that key and message pair, admitting a phantom signer. keyValidate now first confirms that the point's curve carries exactly the canonical G1 field, equation, order and cofactor before any subgroup check. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key; the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected.

• CWE-347

• https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891

Published

Oct 3, 2026

Last Modified

Oct 3, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71886In Bouncy Castle for Java before 1.86, the high-level OpenPG…8.2
• CVE-2026-71887In Bouncy Castle for Java before 1.86, the high-level OpenPG…8.2
• CVE-2026-71888In Bouncy Castle for Java before 1.86, the streaming CMS Aut…8.7
• CVE-2026-71889In Bouncy Castle for Java before 1.86, neither copy of PKIXC…8.7
• CVE-2026-7189Insertion of sensitive information into sent data vulnerabil…7.5
• CVE-2026-71890In Bouncy Castle for Java before 1.86, validation of an MLS …8.7
• CVE-2026-71892In Bouncy Castle for Java before 1.86, the opt-in key-size v…6.9
• CVE-2026-71897An improper authorization check in Apache DolphinScheduler a…4.3
• CVE-2026-71898An incorrect authorization check in Apache DolphinScheduler …4.3
• CVE-2026-71899A missing authorization vulnerability exists in the `query-d…6.5
• CVE-2026-71904Multiple DrayTek VigorAP models contain a command injection …7.2
• CVE-2026-71905Multiple DrayTek VigorAP models contain a command injection …7.2