biscuit-auth
Activity
- Latest release
- 1y ago
- Total releases
- 46
- Cadence
- ~21 days
- Last 12 months
- 0
Details
- License
- Apache-2.0
- First release
- Nov 26, 2019
| Version | Released | |
|---|---|---|
6.0.0
unknown
|
6.0.0
unknown
Dependencies (33)
+ 25 more |
|
6.0.0-beta.3
unknown
|
6.0.0-beta.3
unknown
Dependencies (33)
+ 25 more |
|
6.0.0-beta.2
unknown
|
6.0.0-beta.2
unknown
Dependencies (33)
+ 25 more |
|
6.0.0-beta.1
unknown
|
6.0.0-beta.1
unknown
Dependencies (33)
+ 25 more |
|
6.0.0-alpha.2
unknown
|
6.0.0-alpha.2
unknown
Dependencies (33)
+ 25 more |
|
6.0.0-alpha.1
unknown
|
6.0.0-alpha.1
unknown
Dependencies (33)
+ 25 more |
|
5.0.0
unknown
|
5.0.0
unknown
Dependencies (29)
+ 21 more |
|
4.1.1
unknown
1 CVE
CVE-2024-41949
GHSA-p9w4-585h-g3c7
CVE-2024-42350
GHSA-47cq-pc2v-3rmp
GHSA-rgqv-mwc3-c78m
HSEC-2024-0009
Jul 31, 2024
biscuit-auth vulnerable to public key confusion in third party block
Low
Network
Low
High
None
Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a
A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. Consider the following example (nominal case)
Now, with a malicious user:
ImpactTokens with third-party blocks containing Fixed in
5.0.0
References Updated Oct 15, 2025 · Source: OSV.dev |
4.1.1
unknown
Dependencies (28)
+ 20 more |
|
4.1.0
unknown
yanked
1 CVE
CVE-2024-41949
GHSA-p9w4-585h-g3c7
CVE-2024-42350
GHSA-47cq-pc2v-3rmp
GHSA-rgqv-mwc3-c78m
HSEC-2024-0009
Jul 31, 2024
biscuit-auth vulnerable to public key confusion in third party block
Low
Network
Low
High
None
Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a
A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. Consider the following example (nominal case)
Now, with a malicious user:
ImpactTokens with third-party blocks containing Fixed in
5.0.0
References Updated Oct 15, 2025 · Source: OSV.dev |
4.1.0
unknown
yanked
Dependencies (28)
+ 20 more |
|
4.0.0
unknown
1 CVE
CVE-2024-41949
GHSA-p9w4-585h-g3c7
CVE-2024-42350
GHSA-47cq-pc2v-3rmp
GHSA-rgqv-mwc3-c78m
HSEC-2024-0009
Jul 31, 2024
biscuit-auth vulnerable to public key confusion in third party block
Low
Network
Low
High
None
Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a
A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. Consider the following example (nominal case)
Now, with a malicious user:
ImpactTokens with third-party blocks containing Fixed in
5.0.0
References Updated Oct 15, 2025 · Source: OSV.dev |
4.0.0
unknown
Dependencies (28)
+ 20 more |
|
3.2.0
unknown
|
3.2.0
unknown
Dependencies (26)
+ 18 more |
|
3.1.0
unknown
|
3.1.0
unknown
Dependencies (26)
+ 18 more |
|
3.0.0
unknown
|
3.0.0
unknown
Dependencies (26)
+ 18 more |
|
3.0.0-alpha4
unknown
|
3.0.0-alpha4
unknown
Dependencies (25)
+ 17 more |
|
3.0.0-alpha3
unknown
|
3.0.0-alpha3
unknown
Dependencies (25)
+ 17 more |
|
3.0.0-alpha2
unknown
|
3.0.0-alpha2
unknown
Dependencies (24)
+ 16 more |
|
3.0.0-alpha1
unknown
|
3.0.0-alpha1
unknown
Dependencies (24)
+ 16 more |
|
2.2.0
unknown
|
2.2.0
unknown
Dependencies (22)
+ 14 more |
|
2.1.0
unknown
|
2.1.0
unknown
Dependencies (21)
+ 13 more |
|
2.0.1
unknown
|
2.0.1
unknown
Dependencies (21)
+ 13 more |
|
1.2.0
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
1.2.0
unknown
Dependencies (21)
+ 13 more |
|
2.0.0
unknown
|
2.0.0
unknown
Dependencies (21)
+ 13 more |
|
2.0.0-beta9
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta9
unknown
Dependencies (21)
+ 13 more |
|
2.0.0-beta8
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta8
unknown
Dependencies (21)
+ 13 more |
|
2.0.0-beta7
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta7
unknown
Dependencies (20)
+ 12 more |
|
2.0.0-beta6
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta6
unknown
Dependencies (20)
+ 12 more |
|
2.0.0-beta5
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta5
unknown
Dependencies (19)
+ 11 more |
|
2.0.0-beta4
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta4
unknown
Dependencies (19)
+ 11 more |
|
2.0.0-beta3
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta3
unknown
Dependencies (19)
+ 11 more |
|
2.0.0-beta2
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta2
unknown
Dependencies (19)
+ 11 more |
|
2.0.0-beta1
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
2.0.0-beta1
unknown
Dependencies (19)
+ 11 more |
|
1.1.0
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
1.1.0
unknown
Dependencies (18)
+ 10 more |
|
1.0.1
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
1.0.1
unknown
Dependencies (18)
+ 10 more |
|
1.0.0
unknown
1 CVE
CVE-2022-31053
GHSA-75rw-34q6-72cr
GO-2022-0564
HSEC-2023-0002
Jun 17, 2022
Signature forgery in Biscuit
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactThe paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2. We are not aware of any active exploitation of this vulnerability. PatchesThe version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. WorkaroundsThere is no known workaround, any use of Biscuit v1 should be migrated to v2. ReferencesCryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin For more informationIf you have any questions or comments about this advisory:
Fixed in
2.0.0
References Updated Feb 04, 2026 · Source: OSV.dev |
1.0.0
unknown
Dependencies (18)
+ 10 more |
|
1.0.0-alpha1
unknown
|
1.0.0-alpha1
unknown
Dependencies (18)
+ 10 more |
|
0.9.0
unknown
|
0.9.0
unknown
Dependencies (17)
+ 9 more |
|
0.8.0
unknown
|
0.8.0
unknown
Dependencies (17)
+ 9 more |
|
0.7.0
unknown
|
0.7.0
unknown
Dependencies (16)
+ 8 more |
|
0.6.0
unknown
|
0.6.0
unknown
Dependencies (12)
+ 4 more |
|
0.5.2
unknown
|
0.5.2
unknown
Dependencies (12)
+ 4 more |
|
0.5.1
unknown
|
0.5.1
unknown
Dependencies (12)
+ 4 more |
|
0.5.0
unknown
|
0.5.0
unknown
Dependencies (12)
+ 4 more |
|
0.4.0
unknown
|
0.4.0
unknown
Dependencies (12)
+ 4 more |
|
0.3.0
unknown
|
0.3.0
unknown
Dependencies (12)
+ 4 more |
|
0.2.0
unknown
|
0.2.0
unknown
Dependencies (10)
+ 2 more |
|
0.1.0
unknown
|
0.1.0
unknown
Dependencies (10)
+ 2 more |