Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 have a vulnerability in the KCCMBlockCipher MAC implementation where the nonce is not bound when Additional Authenticated Data (AAD) is absent. This flaw allows a cross-nonce AEAD forgery attack, undermining the integrity guarantees of the cipher.