The vulnerability arises from improper input validation in the DHAgreement.CalculateAgreement function implementing the MTI/A0 two-pass Diffie-Hellman protocol in bc-csharp versions prior to 2.7.0. An attacker positioned on the communication path can supply crafted out-of-range or small-order ephemeral values that bypass range and subgroup-membership checks. This allows the attacker to cause the local party to compute a known agreed value, defeating the key authentication guarantees of MTI/A0. Additionally, a malicious peer can learn the local static private key modulo small factors of p-1 and potentially recover it entirely in groups with many such factors. The flaw specifically affects applications that invoke DHAgreement directly, as the vulnerability exploits the lack of proper validation on ephemeral values raised to the static private key.

An on-path attacker can manipulate the Diffie-Hellman key agreement to force the local party to compute a predictable shared secret, undermining the key authentication property of the MTI/A0 protocol. Furthermore, the attacker can extract partial information about the local static private key and, in some group configurations, fully recover it. This compromises the confidentiality and integrity of the cryptographic session and potentially exposes long-term private keys, leading to severe cryptographic failures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using DHAgreement directly in bc-csharp versions before 2.7.0 or implement strict input validation to ensure ephemeral values are within valid ranges and belong to the correct subgroup. Monitor vendor communications for updates and apply official patches promptly once released.