CVE-2020-10185

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP

published March 5, 2020

CVSS
—
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01682 · 76.8th percentile
Published
2020-03-05T22:48Z
EPSS history
Timeline
  • 05 MAR 22:48Z
    The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP
    cvelistv5