Bouncy Castle crypto authentication bypass vulnerability revealed

Wow, this wins the facepalm award:

"The code checks for an index of characters from 0 to 59 inclusive, rather than checking that characters at positions from 0 to 59 match," reads the report published by Synopsys."

    for (int i = 0; i != sLength; i++)
    {
      isEqual &= (bcryptString.indexOf(i) == newBcryptString.indexOf(i));
    }

In other words, the indexOf() should be at().