The vulnerability resides in the KCCMBlockCipher implementation in Bouncy Castle for Java. When the additional authenticated data field is omitted, the cipher’s message authentication code does not bind the nonce to the MAC. This omission permits an attacker to forge ciphertexts for a different nonce, thus creating valid-cryptographic messages that were not originally generated. The result is an authentication bypass that can undermine confidentiality, integrity, or both depending on the application’s use of the encrypted data. The weakness is classified as CWE‑354, which reflects improper integrity protection.

Affected vendor is Bouncy Castle Inc. Products BC-JAVA and BC-LTS-JAVA are impacted. Versions before 1.85 of BC-JAVA and before 2.73.12 of BC-LTS-JAVA contain the flaw, as indicated by the advisory and the commit history.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be leveraged by anyone who can feed crafted data to the library; the attack path requires the receiver to use KCCMBlockCipher without providing AAD. No environmental preconditions beyond normal usage of the cipher are specified.