CVE-2022-47930

CVE-2022-47930 affects IO FinNet tss-lib versions prior to 2.0.0, stemming from a flaw in its Schnorr proof of knowledge implementation that neglects to use a session ID, context, or random nonce in challenge generation. This oversight allows for message replay and spoofing, enabling a malicious actor or eavesdropper to reuse valid proofs. Rated Medium severity with a CVSS score of 6.8, the vulnerability has a network attack vector and high impact on confidentiality and integrity, but requires high attack complexity and low privileges. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.