What’s Vulnerable › Vulnerabilities
CVE-2024-41948: biscuit-java vulnerable to public key confusion in third party block
- Severity: medium (CVSS 5.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-01 · updated 2026-06-17
- Weakness: CWE-1259
Description
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it, which includes the public key of the previous block (used in the signature) and the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. This vulnerability is fixed in 4.0.0.
Affected products
- biscuit-auth biscuit-java: from 3.0.0 before 4.0.0 — fixed in 4.0.0
How to fix
Upgrade to a fixed version: biscuit-auth biscuit-java 4.0.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-41948 or the next vulnerability affects your stack