{"action":"Upgrade biscuit-auth to 5.0.0 or later.","affected":[{"fixed":"5.0.0","introduced":"4.0.0"}],"component":"biscuit-auth","cve_ids":["CVE-2024-41949","CVE-2024-42350"],"ecosystem":"crates.io","epss":0.00237,"exploited":false,"fixed_versions":["5.0.0"],"ghsa_id":"GHSA-p9w4-585h-g3c7","id":"tcs_01M5KF21R5M1DT1Q1TP4QHC81Q","modified_at":"2025-10-15T13:12:21.549202Z","published_at":"2024-07-31T21:15:41Z","references":["https://osv.dev/vulnerability/GHSA-p9w4-585h-g3c7","https://github.com/biscuit-auth/biscuit-rust/security/advisories/GHSA-p9w4-585h-g3c7","https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-rgqv-mwc3-c78m","https://nvd.nist.gov/vuln/detail/CVE-2024-41949","https://github.com/biscuit-auth/biscuit-rust"],"severity":{"label":"low","score":3},"sources":[{"source":"osv","source_id":"GHSA-p9w4-585h-g3c7","url":"https://osv.dev/vulnerability/GHSA-p9w4-585h-g3c7"}],"summary":"biscuit-auth vulnerable to public key confusion in third party block"}