CVE-2025-23013

Description

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.

• How can I get the fixes?
• What do statuses mean?
• Patch details

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Patch details

References

• MITRE
• NVD
• Launchpad
• Debian

Related Ubuntu Security Notices (USN)

• USN-7806-1
• PAM/U2F vulnerability
• 6 October 2025

Other references

• https://www.cve.org/CVERecord?id=CVE-2025-23013
• https://www.yubico.com/support/security-advisories/ysa-2025-01/
• https://www.openwall.com/lists/oss-security/2025/01/15/1
• http://www.openwall.com/lists/oss-security/2025/01/15/1