CVE detail
CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
No excerpt available.
Vendor Advisorylists.debian.orgJan 15, 2025, 4:15 AM- http://www.openwall.com/lists/oss-security/2025/01/16/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 15, 2025, 4:15 AM - http://www.openwall.com/lists/oss-security/2025/01/16/4www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 15, 2025, 4:15 AM - http://www.openwall.com/lists/oss-security/2025/01/16/3www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 15, 2025, 4:15 AM - http://www.openwall.com/lists/oss-security/2025/01/16/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 15, 2025, 4:15 AM - http://www.openwall.com/lists/oss-security/2025/01/15/1www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 15, 2025, 4:15 AM No excerpt available.
referencewww.yubico.comJan 15, 2025, 4:15 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-25085CVSS 8.6 · High
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate v…
- CVE-2025-48510CVSS 7.1 · High
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
- CVE-2025-12516CVSS 10.0 · Critical
Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
- CVE-2025-12515CVSS 10.0 · Critical
Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
- CVE-2025-22854CVSS 6.9 · Medium
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
- CVE-2024-1713CVSS 7.2 · High
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.