bitcoinj Signature Verification Bypass in P2PKH and P2WPKH

CVE-2026-44714 is a critical cryptographic validation flaw in the bitcoinj library affecting Bitcoin transaction verification. The vulnerability exists in the ScriptExecution.correctlySpends() method, where fast-path optimizations for standard payment types (P2PKH and native P2WPKH) verify attacker-supplied signature and public-key pairs without confirming that the public key matches the one committed to by the output being spent. This allows attackers to forge valid signatures for transactions they shouldn't be able to sign, effectively enabling unauthorized fund transfers. Any application or service using bitcoinj versions prior to 0.17.1 for transaction validation—including cryptocurrency exchanges, wallet implementations, payment processors, and blockchain nodes—faces the risk of accepting fraudulent transactions as legitimate.

While no MITRE ATT&CK techniques are formally mapped to this vulnerability, practitioners using Casky would detect attack patterns aligned with Credential Access and Impact objectives. Claude's extended reasoning capabilities would flag anomalous signature verification patterns—specifically, transactions where cryptographic proofs succeed despite mismatched key material, or repeated acceptance of transactions from unexpected keypairs. Security teams would observe findings related to signature validation failures that should have been caught, unusual transaction acceptance rates from unauthenticated sources, and blockchain ledger inconsistencies indicating accepted unauthorized spends. Detection would focus on behavioral analysis of transaction processing logs, identifying when the verification logic succeeds despite insufficient cryptographic commitment validation. Practitioners should prioritize patching to bitcoinj 0.17.1+ and auditing transaction histories for suspicious accepted spends.