PT-2022-20491 · Biscuit · Biscuit

Geal · Published 2022-06-13 · Updated 2025-11-14 · CVE-2022-31053

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Biscuit versions 1

Description The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. This would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. There are no known workarounds for this issue. As Biscuit v1 was still an early version and not broadly deployed, all known users of Biscuit v1 were contacted and helped to migrate to Biscuit v2. There is no known active exploitation of this vulnerability.

Recommendations For Biscuit versions 1, migrate to Biscuit version 2 to resolve the issue, as version 2 mandates a different algorithm than gamma signatures and is not affected by this vulnerability.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-31053

GHSA-75RW-34Q6-72CR

GO-2022-0564

HSEC-2023-0002

Affected Products

Biscuit

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31053.json · Exploit
• 🔥 https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr · Exploit
• 🔥 https://eprint.iacr.org/2020/1484 · Exploit
• https://osv.dev/vulnerability/HSEC-2023-0002 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0564 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75rw-34q6-72cr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31053 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31053 · Vendor Advisory
• https://github.com/biscuit-auth/biscuit · Note
• https://github.com/haskell/security-advisories · Note
• https://t.me/cibsecurity/44337 · Telegram Post
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note
• https://haskell.github.io/security-advisories · Note
• https://github.com/advisories/GHSA-75rw-34q6-72cr · Note
• https://pkg.go.dev/vuln/GO-2022-0564 · Note