CVE-2025-23013
Feb. 3, 2025, 10:15 a.m.
None
No Score
Description
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
Product(s) Impacted
| Product | Versions |
|---|---|
| Yubico pam-u2f |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-394
Unexpected Status Code or Return Value
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
References
Tags
Timeline
Published: Jan. 15, 2025, 4:15 a.m.
Last Modified: Feb. 3, 2025, 10:15 a.m.
Last Modified: Feb. 3, 2025, 10:15 a.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cve@mitre.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.