Cloudanix VulnDB

CVE-2025-24531

Medium · 6.7

CVSS

6.7

EPSS

0.2%

Published

Jan 16, 2026

CISA due date

—

The record

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Affected packages

Ecosystem Package Introduced Fixed
openSUSE:Tumbleweed pam_pkcs11 0 0.6.13-1.1

Related vulnerabilities