Description
Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Yubico | YubiKey | 5.4.1 – < 5.7.4 | 5.7.4 |
Advisories 1
- WID-SEC-2025-0685 Yubico YubiKey: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Apr 2, 2025