CVE-2023-40660: opensc_project opensc Improper Authentication
Vulnerability summary
CVE-2023-40660 is a medium (CVSS 6.6) Improper Authentication vulnerability in opensc_project opensc. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 06-11-2023PublishedVulnerability first disclosed.
- 06-11-2025Last modifiedVulnerability information updated.
Description
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST6.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.11 pp
From 0.92% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- opensc< 0.23.0-0.3+deb12u1 | < 0.23.0-2
Opensc_project1 product
- opensc≤ 0.23.0
Redhat1 product
- enterprise_linux8.0 | 9.0
Ubuntu1 product
- opensc< 0.20.0-3ubuntu0.1~esm4 | < 0.22.0-1ubuntu2+esm1
4 vendors · 4 products
References
18 links- github.com/OpenSC/OpenSC/issues/2792Issue Tracking
- github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1Release Notes
- github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisoriesVendor Advisory
- www.openwall.com/lists/oss-security/2023/12/13/2X Transferred
- lists.fedoraproject.org/archives/…X Transferred
Show all 18 references
- lists.fedoraproject.org/archives/…X Transferred
