CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product...
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
CVE-2025-23013- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-394
- Updated
- 2026-11-02
EUVDEUVD-2025-3074
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
EUVD-2025-3074- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wwr4-cj7g-985f
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product...
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
GHSA-wwr4-cj7g-985f- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-394
- Updated
- 2026-11-02
NVD
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
CVE-2025-23013- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-394
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
ALPINE-CVE-2025-23013- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-03
OSVDEBIAN-CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
DEBIAN-CVE-2025-23013- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
UBUNTU-CVE-2025-23013- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSV No score
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
- Record
CVE-2025-23013- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14650-1 No score
pam_u2f-1.3.1-1.1 on GA media
These are all security issues fixed in the pam_u2f-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14650-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0167-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517)
- Record
SUSE-SU-2025:0167-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0192-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517)
- Record
SUSE-SU-2025:0192-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0198-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517)
- Record
SUSE-SU-2025:0198-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0200-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517)
- Record
SUSE-SU-2025:0200-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20132-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
-
update to 1.3.2:
- Relax authfile permission check to a warning instead of an error to prevent a breaking change locking existing users out of their systems.
-
update to 1.3.1:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517). - Changed return value when nouserok is enabled and the user has no credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
- Hardened checks of authfile permissions.
- Hardened checks for nouserok.
- Improved debug messages.
- Improved documentation.
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
- Record
SUSE-SU-2025:20132-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20231-1 No score
Security update for pam_u2f
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in
pam_sm_authenticate()(bsc#1233517).
- Record
SUSE-SU-2025:20231-1- Updated
- 2026-11-02
OSVUSN-7806-1 No score
pam-u2f vulnerability
It was discovered that PAM/U2F could allow for authentication bypass in some configurations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service.
- Record
USN-7806-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pam-u2fAlpine:v3.20 |
before 1.3.2-r0 | 1.3.2-r0 |
pam-u2fAlpine:v3.21 |
before 1.3.2-r0 | 1.3.2-r0 |
pam-u2fAlpine:v3.22 |
before 1.3.1-r0 | 1.3.1-r0 |
pam-u2fAlpine:v3.23 |
before 1.3.1-r0 | 1.3.1-r0 |
pam-u2fAlpine:v3.24 |
before 1.3.1-r0 | 1.3.1-r0 |
pam-u2fDebian:12 |
before 1.1.0-1.1+deb12u1, plus listed versions 1.1.0-1.1 |
1.1.0-1.1+deb12u1 |
pam-u2fDebian:13 |
before 1.3.1-1 | 1.3.1-1 |
pam-u2fDebian:14 |
before 1.3.1-1 | 1.3.1-1 |
pam-u2fDebian:11 |
before 1.1.0-1.1+deb11u1, plus listed versions 1.1.0-1.1 |
1.1.0-1.1+deb11u1 |
pam_u2fSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 1.2.0-150600.10.5.1 | 1.2.0-150600.10.5.1 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pam_u2fopenSUSE:Leap 15.6 |
before 1.2.0-150600.10.5.1 | 1.2.0-150600.10.5.1 |
pam_u2fSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 1.0.8-150000.3.6.1 | 1.0.8-150000.3.6.1 |
pam_u2fSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 1.0.8-150000.3.6.1 | 1.0.8-150000.3.6.1 |
pam_u2fSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 1.0.8-150000.3.6.1 | 1.0.8-150000.3.6.1 |
pam_u2fSUSE:Enterprise Storage 7.1 |
before 1.0.8-150000.3.6.1 | 1.0.8-150000.3.6.1 |
pam_u2fSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 1.0.8-3.6.1 | 1.0.8-3.6.1 |
pam_u2fSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.0.8-3.6.1 | 1.0.8-3.6.1 |
pam_u2fSUSE:Linux Enterprise Micro 5.3 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Micro 5.4 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Micro 5.5 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Manager Proxy 4.3 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Manager Server 4.3 |
before 1.2.0-150400.4.5.1 | 1.2.0-150400.4.5.1 |
pam_u2fSUSE:Linux Micro 6.0 |
before 1.3.2-1.1 | 1.3.2-1.1 |
pam_u2fSUSE:Linux Micro 6.1 |
before 1.3.0-slfo.1.1_2.1 | 1.3.0-slfo.1.1_2.1 |
pam-u2fUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.1-11.0.2-11.0.3-1 |
None known |
pam-u2fUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.4-2 |
None known |
pam-u2fUbuntu:Pro:20.04:LTS |
before 1.0.8-1ubuntu0.1~esm1, plus listed versions 1.0.8-1 |
1.0.8-1ubuntu0.1~esm1 |
pam-u2fUbuntu:22.04:LTS |
before 1.1.0-1.1+deb12u1build0.22.04.1, plus listed versions 1.1.0-1.11.1.0-1.1build1 |
1.1.0-1.1+deb12u1build0.22.04.1 |
pam-u2fUbuntu:24.04:LTS |
before 1.1.0-1.1+deb12u1build0.24.04.1, plus listed versions 1.1.0-1.1build11.1.0-1.1build21.1.0-1.1build3 |
1.1.0-1.1+deb12u1build0.24.04.1 |
pam_u2fopenSUSE:Tumbleweed |
before 1.3.1-1.1 | 1.3.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23013 is a high vulnerability (CVSS 7.3) in Yubico Pam-u2f, published January 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in pam-u2f 1.3.2-r0.
References
yubico.com/support/security-advisories/ysa-2025-01
openwall.com/lists/oss-security/2025/01/15/1
Show 17 moreShow less
lists.debian.org/debian-lts-announce/2025/02/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2025-23013
github.com/advisories/GHSA-wwr4-cj7g-985f
security.alpinelinux.org/vuln/CVE-2025-23013
security-tracker.debian.org/tracker/CVE-2025-23013
suse.com/support/update/announcement/2025/suse-su-20250167-1
bugzilla.suse.com/1233517
ubuntu.com/security/CVE-2025-23013
cve.org/CVERecord?id=CVE-2025-23013