Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-24531

Good to know:

icon

Date: January 15, 2026

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2025-24531
https://seclists.org/oss-sec/2025/q1/109
https://github.com/OpenSC/pam_pkcs11/releases
https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch
http://www.openwall.com/lists/oss-security/2025/02/06/7
https://www.openwall.com/lists/oss-security/2025/02/06/3
http://www.openwall.com/lists/oss-security/2025/02/06/3
https://www.mend.io/vulnerability-database/CVE-2025-24531

Severity Score

Weakness Type (CWE)

Authentication Bypass Using an Alternate Path or Channel

CWE-288

Return of Wrong Status Code

CWE-393

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us