Skip to main content

Red Hat CVE-2025-24531

MEDIUM
Return of Wrong Status Code (CWE-393)
2026-01-16 cve@mitre.org
Authentication Bypass Red Hat Suse
6.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.7 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 16, 2026 - 18:16 nvd
MEDIUM 6.7

DescriptionCVE.org

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

AnalysisAI

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass. [CVSS 6.7 MEDIUM]

Technical ContextAI

Affects In OpenSC pam_pkcs11. In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Affected ProductsAI

Product: In OpenSC pam_pkcs11. Versions: up to 0.6.13.

RemediationAI

Monitor vendor advisories for a patch.

Same weakness CWE-393 – Return of Wrong Status Code

View all
CVE-2024-49117 HIGH
8.8
CVE-2025-5987 HIGH
8.1
CVE-2026-53092 HIGH
7.8
CVE-2020-5401 MEDIUM
5.3
CVE-2025-32414 MEDIUM POC
5.6

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Micro 6.0 Fixed
SUSE Linux Micro 6.1 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

Share

CVE-2025-24531 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy