CVE-2025-24531

Description

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

References

https://www.openwall.com/lists/oss-security/2025/02/06/3

https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch

https://github.com/OpenSC/pam_pkcs11/releases

http://www.openwall.com/lists/oss-security/2025/02/06/7

http://www.openwall.com/lists/oss-security/2025/02/06/3

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS