CVE-2025-24531

criticalpriority · track · 0EPSS 0.002 · 14 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (14th) EPSS

CVSS 9.4 · critical

Is it mine?

10 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

cvss

Technical severity, 0–10. One row per scoring source.

9.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.1–9.4

v3.19.4criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.16.7mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · cve@mitre.org USexploitability 1.4 · impact 5.2

v3.16.1mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-305USCWE-393US

affected products (10)

Products and version ranges known to be affected.

Open Source OpenSC pam_pkcs11 0.6.12all versionscert_bundDEcpe:/a:opensc:opensc:pam_pkcs11_0.6.12
Open Source OpenSC pam_pkcs11 <0.6.13all versionscert_bundDE
Open Source OpenSC≤ pam_pkcs11 <0.6.13cert_bundDE
OpenSC project pam_pkcs110.6.12 → 0.6.13enisa_euvdEU
OpenSC Project PAM-PKCS#11≤ 0.6.12fstec_bduRU
АО «ИВК» Альт 8 СПall versionsfstec_bduRU
АО «НТЦ ИТ РОСА» ROSA Virtualization 3.0≤ 3.0fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 3.8fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.8fstec_bduRU

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0141OpenSC (pam_pkcs11): Schwachstelle ermöglicht Umgehen von AuthentifizierungDeutsch2026-01-18csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in OpenSC (pam_pkcs11) ausnutzen, um die Authentifizierung zu umgehen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2026-01-16modified 2026-06-17

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan