---
id: CVE-2026-71891
title: >-
  In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and
  so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and
  ProofOfPossession verify and aggregateVerify that gate on it, accepted a
  public key bui…
summary: >-
  In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and
  so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and
  ProofOfPossession verify and aggregateVerify that gate on it, accepted a
  public key bui…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber'
cwe:
  - CWE-347
vendor: Legion of the Bouncy Castle Inc.
product: bcprov
affected:
  - bcprov >= 1.85 < 1.86
published: '2026-10-03'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T09:17:05.763'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71891'
references:
  - url: >-
      https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb
    label: 91579145-5d7b-4cc5-b925-a0262ff19630
  - url: 'https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891'
    label: 91579145-5d7b-4cc5-b925-a0262ff19630
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-10-03T09:42:13.789Z'
---

## Overview

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a point contributes the identity in the target group, so an aggregate signature verified against a set of public keys including it is accepted even though it contains no signature for that key and message pair, admitting a phantom signer. keyValidate now first confirms that the point's curve carries exactly the canonical G1 field, equation, order and cofactor before any subgroup check. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key; the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.