CVE-2023-20199

CVE-2023-20199 is a medium-severity vulnerability in Cisco Duo Two-Factor Authentication for macOS that allows an authenticated, physical attacker to bypass secondary authentication. This flaw occurs when Duo is configured to "fail open" and incorrectly handles authentication responses, enabling an attacker with primary credentials to gain unauthorized access to the macOS device. The CVSS score is 6.6, indicating a physical attack vector with low complexity, leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.