Clever Cloud

clever-cloud

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Biscuit Java

biscuit-java

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-31053 2Biscuitsec Clever Cloud 4Biscuit Auth Biscuit GoBiscuit Haskell+1 more Jun 17, 2026 Jun 13, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an...Show more Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2022-31053

2Biscuitsec

Clever Cloud

4Biscuit Auth

Biscuit GoBiscuit Haskell+1 more

Jun 17, 2026

Jun 13, 2022

N/A· v4

9.8 CRITICAL· v3

7.5 HIGH· v2

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.Show less