CVE-2022-47930

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.

• CWE-294
• CWE-294

• https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0Release Notes
• https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
• https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0Release Notes
• https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b

Published

Apr 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47925The validate JSON endpoint of the Secvisogram csaf-validator…7.5
• CVE-2022-47926AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/…9.8
• CVE-2022-47927An issue was discovered in MediaWiki before 1.35.9, 1.36.x t…5.5
• CVE-2022-47928In MISP before 2.4.167, there is XSS in the template file up…6.1
• CVE-2022-47929In the Linux kernel before 6.1.6, a NULL pointer dereference…5.5
• CVE-2022-4793The Blog Designer WordPress plugin before 2.4.1 does not val…5.4
• CVE-2022-47931IO FinNet tss-lib before 2.0.0 allows a collision of hash va…9.1
• CVE-2022-47932Brave Browser before 1.43.34 allowed a remote attacker to ca…6.5
• CVE-2022-47933Brave Browser before 1.42.51 allowed a remote attacker to ca…6.5
• CVE-2022-47934Brave Browser before 1.43.88 allowed a remote attacker to ca…6.5
• CVE-2022-47935A vulnerability has been identified in JT Open (All versions…7.8
• CVE-2022-47936A vulnerability has been identified in JT Open (All versions…7.8