The vulnerability arises because the message authentication code (MAC) key is derived directly from the key derivation output immediately following a keystream equal in length to the message. Since the derivation input depends only on a static key pair and fixed parameters, the keystream revealed by a single known plaintext encrypted message contains the MAC key for all sufficiently shorter messages. This enables an attacker to craft ciphertext and MAC tags for forged messages that will be accepted as authentic by the recipient. The issue affects bc-csharp versions from 0 up to but not including 2.7.0.

An attacker who can observe one encrypted message with known plaintext can forge shorter messages that the recipient accepts as authentic. This compromises message integrity and authenticity, potentially allowing unauthorized message injection or manipulation without detection. The vulnerability does not require privileges or user interaction but does require the attacker to have observed a valid encrypted message with known plaintext. There are no known exploits in the wild at this time.

A fixed version 2.7.0 or later of bc-csharp addresses this vulnerability. Users should upgrade to version 2.7.0 or newer to remediate this issue. Since no vendor advisory or patch link is provided, check the official Legion of the Bouncy Castle Inc. resources for the patch and further guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.