CVE-2025-24531

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-16 · updated 2026-06-17
Weakness: CWE-393

Description

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Affected products

OpenSC pam_pkcs11: from 0.6.12 before 0.6.13 — fixed in 0.6.13

How to fix

Upgrade to a fixed version: OpenSC pam_pkcs11 0.6.13. Check the vendor advisory for mitigations.

References

https://github.com/OpenSC/pam_pkcs11/releases
https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch
https://www.openwall.com/lists/oss-security/2025/02/06/3
http://www.openwall.com/lists/oss-security/2025/02/06/3
http://www.openwall.com/lists/oss-security/2025/02/06/7

Get alerted when CVE-2025-24531 or the next vulnerability affects your stack