QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-31053

Back to search

CVE-2022-31053

Published: Jun 13, 2022

Modified: Apr 22, 2025

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.

VendorProductVersions

biscuit-auth

biscuit

affected
biscuit-auth >= 1.0.0, < 2.0.0
affected
biscuit-haskell = 0.1.1.0
affected
com.clever-cloud.biscuit-java < 2.0.0
affected
github.com/biscuit-auth/biscuit-go < 2.0

Weaknesses (CWE)

CWE-347

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now