CVE-2025-29991

Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.

Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.

Las versiones 5.4.1 a 5.7.3 de Yubico YubiKey, anteriores a la 5.7.4, tienen una implementación incorrecta del Protocolo de autenticación FIDO CTAP PIN/UV 2. Utilizan la longitud de firma del Protocolo de autenticación CTAP PIN/UV 1, incluso cuando se eligió este protocolo, lo que resulta en una verificación de firma parcial.