CVE-2020-28052

CVE-2020-28052 is a high-severity vulnerability in the Bouncy Castle BC Java library (versions 1.65 and 1.66) that affects products from Apache, Bouncy Castle, and Oracle. The flaw lies in the OpenBSDBCrypt.checkPassword method, which incorrectly compares password data, potentially allowing incorrect passwords to be validated as correct. With a CVSS score of 8.1, this vulnerability presents a critical risk due to its network attack vector and high impact on confidentiality, integrity, and availability, despite high attack complexity. Although there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.