Yubico vulnerabilities

Products

• Pam-u2f 4
• Yubihsm-shell 4
• Yubikey 5 Nfc Firmware 3
• Libu2f-host 2
• Libykpiv 2
• Piv Manager 2
• Piv Tool 2
• Piv Tool Manager 2
• Smart Card Minidriver 2
• Yubikey One Time Password Validation Server 2
• Yubikey Smart Card Minidriver 2

Newest

• yubico webauthn-server-core Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a... CVE-2026-46419 7.5 HighMay 14, 2026
• yubico libfido2, python-fido2, yubikey-manager +2 more Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have... CVE-2026-40947 2.9 LowApril 15, 2026
• yubico yubikey Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol... CVE-2025-29991 2.2 LowApril 3, 2025
• yubico pam-u2f In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product... CVE-2025-23013 Fix available 7.3 HighJanuary 15, 2025
• yubico security key c nfc by yubico firmware, security key nfc by yubico firmware, yubihsm 2 fips firmware +15 more +17 more Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware... CVE-2024-45678 4.2 MediumSeptember 3, 2024
• yubico yubikey manager gui ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows... CVE-2024-31498 8.8 HighApril 4, 2024
• yubico yubihsm 2 sdk The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of... CVE-2023-39908 7.5 HighAugust 14, 2023
• yubico otp Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with... CVE-2022-24584 Disputed 6.5 MediumMay 11, 2022
• yubico ykneo-openpgp Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first... CVE-2015-3298 8.8 HighMarch 29, 2022
• yubico yubihsm 2 software development kit The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not... CVE-2021-43399 7.5 HighDecember 8, 2021
• yubico pam-u2f, fedoraproject fedora +1 more Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and... CVE-2021-31924 Fix available 6.8 MediumMay 25, 2021
• yubico yubihsm-shell An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.... CVE-2021-32489 4.4 MediumMay 10, 2021
• fedoraproject fedora, yubico yubihsm connector +1 more Infinite loop in Yubico yubihsm-connector CVE-2021-28484 Fix available 7.5 HighApril 14, 2021
• yubico yubihsm-shell An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.... CVE-2021-27217 4.4 MediumMarch 4, 2021
• ftsafe k13, k21, k40 +42 more +44 more An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security... CVE-2021-3011 4.2 MediumJanuary 7, 2021
• yubico yubihsm-shell, fedoraproject fedora +1 more An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The... CVE-2020-24388 7.5 HighOctober 19, 2020
• yubico yubihsm-shell, fedoraproject fedora +1 more An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The... CVE-2020-24387 7.5 HighOctober 19, 2020
• yubico yubikey 5 nfc firmware An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5... CVE-2020-15001 5.3 MediumJuly 9, 2020
• yubico yubikey 5 nfc firmware A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has... CVE-2020-15000 5.9 MediumJuly 9, 2020
• yubico libykpiv, piv tool manager, yubikey smart card minidriver +2 more An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect... CVE-2020-13132 Fix available 4.3 MediumJuly 9, 2020
• yubico libykpiv, piv tool manager, yubikey smart card minidriver +2 more An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is... CVE-2020-13131 Fix available 4.3 MediumJuly 9, 2020
• yubico yubikey one time password validation server The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL... CVE-2020-10184 7.5 HighMarch 5, 2020
• yubico yubikey one time password validation server The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an... CVE-2020-10185 8.6 HighMarch 5, 2020
• yubico pam module, debian linux, yubico-pam +2 more Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM... CVE-2011-4120 Fix available 9.8 CriticalNovember 26, 2019
• yubico pam-u2f In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using... CVE-2019-12210 Fix available 8.1 HighJune 4, 2019
• yubico pam-u2f Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico... CVE-2019-12209 Fix available 7.5 HighJune 4, 2019
• yubico libu2f-host In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking... CVE-2019-9578 Fix available 7.5 HighMarch 5, 2019
• yubico libu2f-host, debian linux +1 more Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious... CVE-2018-20340 Fix available 6.8 MediumFebruary 8, 2019
• yubico piv manager, piv tool, smart card minidriver +2 more An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib... CVE-2018-14780 Fix available 4.6 MediumAugust 15, 2018
• yubico piv manager, piv tool, smart card minidriver +2 more A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib... CVE-2018-14779 Fix available 6.8 MediumAugust 15, 2018
• yubico pam In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25,... CVE-2018-9275 Fix available 8.2 HighApril 4, 2018