The vulnerability (CVE-2026-63571) exists in the attribute certificate path validator classes (PkixAttrCertPathValidator and PkixAttrCertPathBuilder) of the Legion of the Bouncy Castle Inc. bc-csharp library versions prior to 2.7.0. The flaw is due to improper verification of the cryptographic signature on X.509 attribute certificates. Specifically, while the validation process performs checks on the holder and issuer certification paths, validity period, extensions, and revocation status, it does not verify the attribute certificate's signature against the issuer's public key. This allows a remote attacker to craft a forged attribute certificate naming a trusted attribute authority as issuer without a valid signature, thereby gaining unauthorized privileges or roles granted by the application based on these attributes. The vulnerability affects only applications that utilize these specific classes for attribute certificate validation.

An attacker can present a forged X.509 attribute certificate that is accepted as valid by vulnerable applications, potentially obtaining unauthorized roles or privileges. This could lead to unauthorized access or actions within the affected application environment. The impact is limited to applications that use the vulnerable classes for attribute certificate validation. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should avoid relying solely on the vulnerable attribute certificate path validator classes for critical authorization decisions or implement additional signature verification steps externally. Monitor vendor communications for updates regarding an official fix.