CVE-2012-6140: Google Authenticator

Low severity, CVSS 1.9. EPSS: 0.2% chance of exploitation in the next 30 days.

pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.

Affected products

• Google Authenticator: up to and including 0.91; version 0.86 only; version 0.87 only

Published 2013-04-24. Last modified 2026-06-16.