CVE-2020-10185 The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP va...
HighCVSS 8.6
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Yubico yubikey one time password validation server | < 2.40 | 2.40 |
References
- github.com release-notes third-party-advisory
- [debian-lts-announce] 20200312 [SECURITY] [DLA 2141-1] yubikey-val security update mailing-list
- www.yubico.com exploit vendor-advisory