{"cve":"CVE-2022-31053","nvd":{"published":"2022-06-13T20:15:07.820","modified":"2026-06-17T04:44:41.777","status":"Modified","description":"Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-347"],"references":["https://eprint.iacr.org/2020/1484","https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr","https://eprint.iacr.org/2020/1484","https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr"],"products":["biscuitsec:biscuit-auth","biscuitsec:biscuit-go","biscuitsec:biscuit-haskell","clever-cloud:biscuit-java"],"source":"nvd","synced_at":"2026-10-19T21:32:39.174919249+00:00"},"epss":{"cve":"CVE-2022-31053","score":0.0101,"percentile":0.63156,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-75rw-34q6-72cr","url":"https://osv.dev/vulnerability/GHSA-75rw-34q6-72cr","summary":"Signature forgery in Biscuit","modified":"2026-02-04T04:12:23.445350Z","packages":[{"ecosystem":"crates.io","name":"biscuit-auth","purl":"pkg:cargo/biscuit-auth","ranges":[">=1.0.0 <2.0.0"],"fixed":["2.0.0"]},{"ecosystem":"Go","name":"github.com/biscuit-auth/biscuit-go","purl":"pkg:golang/github.com/biscuit-auth/biscuit-go","ranges":["<2.0.0"],"fixed":["2.0.0"]},{"ecosystem":"Maven","name":"com.clever-cloud:biscuit-java","purl":"pkg:maven/com.clever-cloud/biscuit-java","ranges":["<2.0.0"],"fixed":["2.0.0"]}]},{"id":"GO-2022-0564","url":"https://osv.dev/vulnerability/GO-2022-0564","summary":"Signature forgery in github.com/biscuit-auth/biscuit-go","modified":"2024-05-20T16:03:47Z","packages":[{"ecosystem":"Go","name":"github.com/biscuit-auth/biscuit-go","purl":"pkg:golang/github.com/biscuit-auth/biscuit-go","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}