CVE-2024-42350 affects Biscuit authorization tokens, specifically their handling of third-party block requests. A malicious actor can trick a third-party authority into generating Datalog that trusts an incorrect keypair, leading to tokens with compromised "trusted" annotations. This vulnerability has a low severity CVSS score of 3.0, indicating a network attack vector with high attack complexity and low impact on integrity, with no confidentiality or availability impact. There are no known active exploits, public exploit code, or significant community discussion surrounding this vulnerability. Users are advised to update their Biscuit implementations to version 4 of the specification, as no workarounds exist.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Biscuit-Auth | Biscuit | < 4CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.