Authorization bypass via forged public-key symbol table

Authorization bypass in Eclipse Biscuit Rust before 5.0.0 allows remote authenticated users to use tokens without required approval. A forged ThirdPartyBlock request replaces an interned public key in the request symbol table, causing the third-party authority to sign Datalog whose trusted-key annotation resolves to an attacker-controlled key. The attacker must hold and attenuate a valid token and reach a third-party authority that generates trusted-annotation blocks; exploitation bypasses a required downstream authorization step.