A vulnerability in biscuit-haskell versions 0.3.0.0 up to but not including 0.4.0.0 allows a malicious user to forge third-party block requests. This can cause the third-party authority to generate datalog trusting an incorrect keypair due to public key confusion in third-party blocks. The issue is fixed in version 0.4.0.0.