This vulnerability (CVE-2026-5588) in BC-JAVA's bcpkix pkix modules arises from the acceptance of an empty signature sequence by the PKIX draft CompositeVerifier, effectively allowing cryptographic verification to succeed without a valid signature. The issue affects versions from 1.49 up to but not including 1.84. The weakness is categorized under CWE-327, indicating the use of a broken or risky cryptographic algorithm. The CVSS 4.0 base score is 10.0, reflecting a critical severity with network attack vector, no required privileges or user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No official patch or remediation level has been provided in the available data.

The vulnerability allows an attacker to bypass cryptographic signature verification by exploiting the acceptance of an empty signature sequence, potentially compromising the integrity and authenticity of data verified using the affected BC-JAVA versions. This can lead to unauthorized data acceptance or manipulation in systems relying on this library for cryptographic validation. The critical CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated, users should monitor the vendor's communications for updates. Until a patch is available, avoid using affected versions (1.49 up to before 1.84) in security-critical environments or implement additional verification controls outside of the vulnerable library if feasible.