bc-csharp: Missing signature verification of attribute certificates
Summary
The attribute certificate path validator in bc-csharp (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) does not verify the signature of an X.509 attribute certificate against the issuer's public key. An attacker can submit a forged attribute certificate that names a trusted attribute authority as issuer, and the library reports it as valid. This can lead to privilege escalation in applications that grant roles or privileges based on validated attribute certificates; only applications using these classes are affected.
Affected
- bc-csharp versions 0 to before 2.7.0 (CNA data)
- BC C# .NET 2.6.2 and earlier, and 2.7.0-beta.98 (vendor wiki)
- Platform: all CLRs
Fixed in
- BC C# .NET 2.7.0
Workaround
- Upgrade to BC C# .NET 2.7.0 or later.
- If upgrading is not possible, call Verify or IsSignatureValid on the X509V2AttributeCertificate with the public key of the attribute authority's certificate and reject the certificate on failure.
- Alternatively, register a PkixAttrCertChecker via PkixParameters.SetAttrCertCheckers; this also covers PkixAttrCertPathBuilder.
Exploitation
- Unknown. No reports of exploitation found.
- No public proof-of-concept code found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Search code and SBOMs for BouncyCastle.Cryptography and for PkixAttrCertPathValidator or PkixAttrCertPathBuilder.
- If the code path is used, upgrade to 2.7.0 or later, or add the signature check described above.
- If the code path is not used, record the finding as not applicable and monitor the advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor wiki: CVE-2026-63571 github.com
- Fix commit c08f65e github.com
- OSV: CVE-2026-63571 osv.dev
- VulDB: CVE-2026-63571 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:11.
Original description (NVD)
Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as valid, and so obtain whatever roles or privileges an application grants on the strength of its attributes, via an attribute certificate that names a trusted attribute authority as its issuer but was not signed by it, because the RFC 3281 validation steps check the holder and issuer certification paths, validity period, extensions and revocation status but never verify the attribute certificate's signature with the issuer's public key. Only applications that use these classes to validate attribute certificates are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.