Read the docs
TI-2025-16826 Aliases CVE-2025-23013GHSA-wwr4-cj7g-985f

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.

Priority LOW 34CWE-394Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Fix Fixed pam-u2f (Yubico): 1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Yubicopam-u2fbefore 1.3.11.3.1Patch availableCNA
  • pam-u2f VendorYubico Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA

Remediation

  • Fix · CNA pam-u2f (Yubico) Fixed in 1.3.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23013
  2. 2026-10-03 Alias added: GHSA-wwr4-cj7g-985f

References

Other 1

  • TI-2023-20808 The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the… CVSS 3.1HIGH 7.5
  • TI-2011-03638 Improper input validation in yubico-pam CVSS 3.1CRITICAL 9.8
  • TI-2020-08207 The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to… CVSS 3.1HIGH 8.6
  • TI-2019-09116 In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set… CVSS 3.0HIGH 8.1
  • TI-2018-06723 In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through… CVSS 3.0HIGH 8.2
  • TI-2015-02918 Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. CVSS 3.1HIGH 8.8
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences