CVE-2024-41949

CVE-2024-41949 affects biscuit-rust, an authentication and authorization token implementation, by allowing a malicious user to forge a ThirdPartyBlock request. This can trick a third-party authority into generating a Datalog block that trusts an incorrect keypair, leading to potential authentication bypass or unauthorized access. The vulnerability has a CVSS score of 6.4 (Medium), indicating a network-based attack with low complexity and privileges, but a change in scope, resulting in low confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.