In Bouncy Castle for Java versions prior to 1.86, the method org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals failed to properly validate the relationship between a Remove proposal's removed leaf and the joiner in MLS external commits as defined by RFC 9420. Specifically, it allowed any party with the group's public GroupInfo to submit a Remove proposal targeting any member's LeafIndex, causing that member's eviction and the attacker taking over their ratchet tree slot. The missing credential check, which should have ensured the removed leaf's credential matched the joiner's new leaf credential, was only present in the gRPC interop harness and not in the public API. The fix enforces this credential check on both sending and receiving ends, preventing unauthorized removals.

An unauthenticated attacker with access to the group's public GroupInfo can evict arbitrary group members by submitting a malicious Remove proposal in an external commit. This allows the attacker to take over the evicted member's position in the ratchet tree, potentially compromising group membership integrity and security. The vulnerability undermines the MLS protocol's protections against unauthorized removals in external joins.

A fix is available in Bouncy Castle for Java version 1.86 that enforces the required credential check for Remove proposals in external commits. Users should upgrade to version 1.86 or later to mitigate this vulnerability. No other mitigation is indicated or required according to the available information.