rootpwn

high · CVSS v3 5.3 · CVSS v4 8.7 · EPSS 0.00249

CVE-2026-71890

Bouncy Castle for Java versions prior to 1.86 allow an external joiner to craft a Remove proposal that evicts any member by specifying an ar

Overview

Bouncy Castle for Java versions prior to 1.86 allow an external joiner to craft a Remove proposal that evicts any member by specifying an arbitrary leaf index. The flaw bypasses credential checks, enabling the attacker to take over a victim’s slot in the MLS ratchet tree. This vulnerability can compromise confidentiality, integrity, and availability of group communications.

Description

In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to do with the joiner. RFC 9420 sec. 12.2 permits at most one Remove proposal in an external commit, with which the joiner removes an old version of themselves, and requires that where one is present the LeafNode in the commit's path field meet the criteria it would have to meet in an Update for the removed leaf, in particular that its credential present identifiers acceptable for the removed participant. The ordinary proposal-list validator's self-remove rule is deliberately not applied on this path, because a resync commit legitimately removes a leaf the joiner owns, but nothing was put in its place. Any party holding the group's public GroupInfo, which is precisely what an external joiner is meant to be given, could therefore commit a Remove naming any member's LeafIndex and have every member apply it, evicting that member and taking over their slot in the ratchet tree. The credential check that should have prevented this existed only in the gRPC interop harness and so protected no other caller of the public Group.externalJoin and Group.handle API. An external commit carrying a Remove is now accepted only when the removed leaf's credential is identical to the one in the joiner's own new leaf, on both the sending and the receiving side.

Impact

Defenders face loss of confidentiality as attackers can impersonate members, integrity breach by altering group state, and availability issues if critical members are removed. The attack targets any system using MLS via Bouncy Castle’s Group.externalJoin or Group.handle APIs, affecting Java applications that rely on Bouncy Castle for secure messaging.

Remediation

Upgrade to Bouncy Castle 1.86 or later where the Remove proposal validation is fixed. If upgrade is not immediately possible, implement a policy to reject external commits containing Remove proposals unless the removed leaf’s credential matches the joiner’s new leaf. Additionally, audit GroupInfo distribution and monitor for anomalous external join attempts.

Risk context

Severity is high with CVSS v4 score 8.7, but the EPSS of 0.00249 indicates a low probability of exploitation. Nonetheless, the potential impact warrants prompt patching or mitigation.

Affected products

  • Bouncy Castle Java 1.85
  • Bouncy Castle Java 1.84
  • Bouncy Castle Java 1.83
  • Bouncy Castle Java 1.82
  • Bouncy Castle Java 1.81
  • Bouncy Castle Java 1.80
  • Bouncy Castle Java 1.79
  • Bouncy Castle Java 1.78

Scores

Severity
high
CVSS v2
6.4
CVSS v3
5.3
CVSS v4
8.7
EPSS
0.00249

BouncyCastle MLS ExternalJoin RemoveProposal Java SecurityPatch GroupInfo

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-97337

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the member's username and plaintext password — to an attacker-chosen address, and to then activate that member's account without their consent.

View analysis

high

CVE-2026-97341

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.

View analysis