Threats Tagged 'cve-2026-71890'

A vulnerability in Bouncy Castle for Java before version 1.86 allows improper validation of MLS external commit proposal lists. This flaw permits an attacker with access to the group's public GroupInfo to submit a Remove proposal evicting any member and taking over their slot in the ratchet tree. The issue arises because the validation did not verify that the removed leaf corresponded to the joiner, missing a critical credential check. The vulnerability is addressed by requiring the removed leaf's credential to match the joiner's new leaf credential on both sending and receiving sides.

CVE-2026-71890 is a high-severity authorization vulnerability in Bouncy Castle for Java versions 1.73 up to but not including 1.86. It involves improper validation of MLS external commit proposal lists, allowing an attacker with access to the group's public GroupInfo to remove any member from the group and take over their slot. The vulnerability arises because the validation did not verify that the removed leaf corresponded to the joiner, enabling unauthorized removal and replacement. The flaw was fixed by enforcing that an external commit carrying a Remove proposal is accepted only when the removed leaf's credential matches the joiner's new leaf credential on both sender and receiver sides.