Yubico vulnerabilities
We track 4 vulnerabilities in Yubico products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 14, 2026.
Latest Yubico vulnerabilities
- 7.5 High severity
webauthn-server-core: Incorrect Check of Function Return Value
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
- 7.3 High severity
pam-u2f: Unexpected Status Code or Return Value
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Li
- 8.8 High severity
yubikey_manager_gui: Improper Privilege Management
Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Administrator.
- 7.5 High severity
Yubihsm 2 SDK: Out-of-bounds Read
The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory.