CVE-2025-23013

published 2025-01-15

CVE-2025-23013: In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be…

Priority P3 43 high 7.3 CVSS 4.0

AV L AC L AT P PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	pam-u2f	< pam-u2f 1.1.0-1.1+deb12u1 (bookworm)	pam-u2f 1.1.0-1.1+deb12u1 (bookworm)
yubico	pam-u2f	< 1.3.1	1.3.1
yubico	pam-u2f	>= 0 < 1.1.0-1.1+deb11u1	1.1.0-1.1+deb11u1
yubico	pam-u2f	>= 0 < 1.1.0-1.1+deb12u1	1.1.0-1.1+deb12u1
yubico	pam-u2f	>= 0 < 1.3.1-1	1.3.1-1
yubico	pam-u2f	>= 0 < 1.3.1-1	1.3.1-1

CVSS provenance

nvd v4.0 7.3 HIGH CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 7.3 HIGH

vendor_debian 7.3 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-394