CVE-2020-10185

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html
https://www.yubico.com/support/security-advisories/ysa-2020-01/Exploit, Vendor Advisory
https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html
https://www.yubico.com/support/security-advisories/ysa-2020-01/Exploit, Vendor Advisory

Timeline

Published: Mar 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101877.5Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret on CVE-2020-101889.8utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, becaus CVE-2020-101899.8Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage CVE-2020-10197.8An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'M CVE-2020-101908.8An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by craft CVE-2020-101915.4An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save e CVE-2020-101926.1An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_CVE-2020-101937.5ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects ve CVE-2020-101946.5cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This di CVE-2020-101956.3The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege CVE-2020-101966.1An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi CVE-2020-101998.8Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).