CVE-2025-24531: Opensc Project Pam PKCS11

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Affected products

• Opensc Project Pam PKCS11: from 0.6.12, before 0.6.13 (fixed in 0.6.13)

Published 2026-01-16. Last modified 2026-06-17.