Local Privilege Escalation in Yubico PAM Implementation on macOS and Linux

CVE-2025-23013

What is CVE-2025-23013?

In certain configurations of Yubico's pam-u2f software prior to version 1.3.1, a local privilege escalation vulnerability can occur, allowing an unprivileged attacker to bypass authentication measures. This vulnerability specifically affects systems where pam-u2f is used to authenticate users with a YubiKey or FIDO compliant devices. To exploit this issue, an attacker may require access to the target system and potentially the user's password, depending on the setup. This could allow unauthorized users to gain higher privileges than intended, posing significant security risks.

News Articles

Forbes

CVE-2025-23013

Yubico Issues Security Advisory As 2FA Bypass Vulnerability Confirmed

Yubico has confirmed a partial 2FA bypass issue could impact some YubiKey customers—here’s what you need to know.

References