CVE-2025-24531
pam-pkcs11 - security update
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
CVE-2025-24531- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-02
EUVDEUVD-2025-206298
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
EUVD-2025-206298- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
NVD
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
CVE-2025-24531- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-02
OSV
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
CVE-2025-24531- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-24531
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
DEBIAN-CVE-2025-24531- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-24531
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
- Record
UBUNTU-CVE-2025-24531- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2025:14738-1 No score
pam_pkcs11-0.6.13-1.1 on GA media
These are all security issues fixed in the pam_pkcs11-0.6.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14738-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20130-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- CVE-2025-24531: Fixed regression in version 0.6.12 returning PAM_IGNORE in many situations with possible authentication bypass (bsc#1236314).
- Record
SUSE-SU-2025:20130-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20225-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- CVE-2025-24531: Fixed regression in version 0.6.12 returning PAM_IGNORE in many situations with possible authentication bypass (bsc#1236314).
- Record
SUSE-SU-2025:20225-1- Updated
- 2026-11-02
OSVUSN-7363-1 No score
pam-pkcs11 vulnerabilities
Marcus Rückert and Matthias Gerstner discovered that PAM-PKCS#11 did not properly handle certain return codes when authentication was not possible. An attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-24531)
It was discovered that PAM-PKCS#11 did not require a private key signature for authentication by default. An attacker could possibly use this issue to bypass authentication. (CVE-2025-24032)
- Record
USN-7363-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pam-pkcs11Debian:12 |
before 0.6.12-1+deb12u1, plus listed versions 0.6.12-1 |
0.6.12-1+deb12u1 |
pam-pkcs11Debian:13 |
before 0.6.13-1 | 0.6.13-1 |
pam-pkcs11Debian:14 |
before 0.6.13-1 | 0.6.13-1 |
pam-pkcs11Debian:12 From an advisory covering 2 CVEs |
before 0.6.12-1+deb12u1, plus listed versions 0.6.12-1 |
0.6.12-1+deb12u1 |
pam_pkcs11SUSE:Linux Micro 6.0 |
before 0.6.12-2.1 | 0.6.12-2.1 |
pam_pkcs11SUSE:Linux Micro 6.1 |
before 0.6.12-slfo.1.1_3.1 | 0.6.12-slfo.1.1_3.1 |
pam-pkcs11Ubuntu:24.04:LTS |
before 0.6.12-2ubuntu0.24.04.1, plus listed versions 0.6.12-10.6.12-20.6.12-2build20.6.12-2build3 |
0.6.12-2ubuntu0.24.04.1 |
pam-pkcs11Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 0.6.8-4ubuntu0.1~esm1, plus listed versions 0.6.8-4 |
0.6.8-4ubuntu0.1~esm1 |
pam-pkcs11Ubuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 0.6.9-2ubuntu0.1~esm1, plus listed versions 0.6.9-10.6.9-20.6.9-2build10.6.9-2build2 |
0.6.9-2ubuntu0.1~esm1 |
pam-pkcs11Ubuntu:20.04:LTS From an advisory covering 2 CVEs |
before 0.6.11-2ubuntu0.1, plus listed versions 0.6.11-2 |
0.6.11-2ubuntu0.1 |
pam-pkcs11Ubuntu:22.04:LTS From an advisory covering 2 CVEs |
before 0.6.11-4ubuntu0.1, plus listed versions 0.6.11-4build10.6.11-4build2 |
0.6.11-4ubuntu0.1 |
pam-pkcs11Ubuntu:24.04:LTS From an advisory covering 2 CVEs |
before 0.6.12-2ubuntu0.24.04.1, plus listed versions 0.6.12-10.6.12-20.6.12-2build20.6.12-2build3 |
0.6.12-2ubuntu0.24.04.1 |
pam_pkcs11openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.6.13-1.1 | 0.6.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24531 is a medium vulnerability (CVSS 6.7) in Opensc Project Pam Pkcs11, published February 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in pam-pkcs11 0.6.12-1+deb12u1.
References
github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch
openwall.com/lists/oss-security/2025/02/06/3
nvd.nist.gov/vuln/detail/CVE-2025-24531
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2025-24531
suse.com/support/update/announcement/2025/suse-su-202520130-1
bugzilla.suse.com/1236314
ubuntu.com/security/CVE-2025-24531
cve.org/CVERecord?id=CVE-2025-24531