CVE-2025-24531 Auth bypass in pam pkcs11
Attackers can bypass authentication by triggering smartcard errors, as the PAM module incorrectly returns ignore status.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24531?
CVE-2025-24531 is a medium-severity authentication bypass vulnerability in OpenSC project pam_pkcs11, published on 16 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
Weakness: CWE-393
Which versions are affected by CVE-2025-24531?
Linux distribution packages (2)
pam_pkcs11 SUSE:Linux Micro 6.0 | All versions | 0.6.12-2.1 |
pam_pkcs11 SUSE:Linux Micro 6.1 | All versions | 0.6.12-slfo.1.1_3.1 |
How do I fix CVE-2025-24531?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-24531 being exploited?
There is no known exploitation of CVE-2025-24531 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-24531, GHSA-7mf6-rg36-qgch, SUSE-SU-2025:20130-1, SUSE-SU-2025:20225-1, UBUNTU-CVE-2025-24531.