CVE-2025-24531

Published: Jan 16, 2026Modified: Jun 17, 2026Deferred

6.7

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.4 / Impact: 5.2

Source: MITRE (Secondary)

Description

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Related CWEs

CWE-393

Return of Wrong Status Code

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

References (5)

https://github.com/OpenSC/pam_pkcs11/releases

Source: cve@mitre.org

https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2025/02/06/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2025/02/06/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/02/06/7

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.