Read the docs
TI-2025-21366 Aliases CVE-2025-29991GHSA-2rq3-x44v-xx2w

Weak authentication in Yubico YubiKey

Priority LOW 10CWE-1390Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00122 2nd percentileScored 2026-11-07
Fix Fixed YubiKey (Yubico): 5.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YubicoYubiKey5.4.1 to before 5.7.45.7.4Patch availableCNA
  • YubiKey VendorYubico Affected 5.4.1 to before 5.7.4 Fixed in 5.7.4 Patch available CNA

Remediation

  • Fix · CNA YubiKey (Yubico) Fixed in 5.7.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29991
  2. 2026-10-03 Alias added: GHSA-2rq3-x44v-xx2w

References

Other 1

  • TI-2023-20808 The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the… CVSS 3.1HIGH 7.5
  • TI-2011-03638 Improper input validation in yubico-pam CVSS 3.1CRITICAL 9.8
  • TI-2020-08207 The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to… CVSS 3.1HIGH 8.6
  • TI-2019-09116 In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set… CVSS 3.0HIGH 8.1
  • TI-2018-06723 In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through… CVSS 3.0HIGH 8.2
  • TI-2015-02918 Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. CVSS 3.1HIGH 8.8
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences