In BC-JAVA before version 1.86, the OpenPGP certificate API methods getCertificationBy() and getDelegationBy() improperly validate third-party certifications by accepting signatures from any component key of the issuing certificate without verifying that the key had the CERTIFY_OTHER flag as required by RFC 9580 section 5.2.3.29. This flaw allows subkeys bound only for signing or encryption, which should not have certification authority, to issue valid User ID certifications or trust delegations. The API returns these as valid signature chains attributed to the issuing certificate, causing applications relying on these methods for trust decisions to mistakenly accept attacker assertions as legitimate. The fix introduced requires that only the primary key or subkeys with the CERTIFY_OTHER flag can issue such certifications or delegations, preserving the intended separation of key capabilities.

This vulnerability enables an attacker controlling a restricted subkey to escalate its authority to that of the primary key for issuing certifications or trust delegations. Applications that rely on the affected API methods to validate identity or trust decisions may incorrectly trust attacker-controlled identities or delegations, potentially leading to unauthorized trust relationships. The vulnerability does not compromise private keys or forge primary key signatures but undermines the containment model enforced by key flags, increasing the risk of trust misuse.

A fix is available in BC-JAVA version 1.86 and later, which enforces that only the primary key or subkeys with the CERTIFY_OTHER key flag can issue third-party certifications or delegations. Users should upgrade to version 1.86 or later to remediate this vulnerability. No additional mitigation actions are necessary once the update is applied.