CVE-2025-24531

CVE-2025-24531 describes an authentication bypass vulnerability in OpenSC pam_pkcs11 versions prior to 0.6.13. The pam_sm_authenticate() function incorrectly returns PAM_IGNORE in various error scenarios, such as smartcard-related issues, allowing an attacker to bypass authentication. This is a medium severity vulnerability (CVSS 6.7) with a local attack vector and high impact on confidentiality and integrity, though it requires high attack complexity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.