Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-40660 Details

Description

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.6 MEDIUMVector:CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:6.6 MEDIUMVector:CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2023:7876	CVE
https://access.redhat.com/errata/RHSA-2023:7879	CVE
https://access.redhat.com/security/cve/CVE-2023-40660	CVE	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2240912	CVE	Issue Tracking
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651	CVE	Issue Tracking
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1	CVE	Release Notes
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories	CVE	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html	CVE
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html	CVE
https://lists.fedoraproject.org/archives/list/[email protected]/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/	CVE
https://lists.fedoraproject.org/archives/list/[email protected]/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/	CVE
http://www.openwall.com/lists/oss-security/2023/12/13/2	CVE
https://access.redhat.com/errata/RHSA-2023:7876	[email protected]
https://access.redhat.com/errata/RHSA-2023:7879	[email protected]
https://access.redhat.com/security/cve/CVE-2023-40660	[email protected]	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2240912	[email protected]	Issue Tracking
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651	[email protected]	Issue Tracking
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1	[email protected]	Release Notes
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories	[email protected]	Vendor Advisory

see all 19 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	[email protected]
CWE-287	Improper Authentication	[email protected]

Affected Products

Product	Versions
opensc project opensc	<= 0.23.0
CPE cpe:2.3:a:opensc_project:opensc:::::::: Remediation No remediation found in references.
redhat enterprise linux	8.0 9.0
CPE cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::* Remediation No remediation found in references.

Change History

15 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 3, 2025	CVE Modified	CVE
Dec 4, 2024	CVE Modified	[email protected]
Nov 23, 2024	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
Sep 16, 2024	CVE Modified	[email protected]
May 14, 2024	CVE Modified	[email protected]
Dec 23, 2023	CVE Modified	[email protected]
Dec 22, 2023	CVE Modified	[email protected]
Dec 19, 2023	CVE Modified	[email protected]
Dec 13, 2023	CVE Modified	[email protected]
Nov 27, 2023	CVE Modified	[email protected]
Nov 14, 2023	Initial Analysis	[email protected]
Nov 7, 2023	CVE Modified	[email protected]