MITRE classifies the gap

nvd.nist.gov • April 17, 2026

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL path.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Yubico Software Vulnerability Allows Code Injection via DLL Path Flaw A security vulnerability affecting YubiKey Manager, libfido2, and python-fido2 has been identified, allowing attackers to execute injected code on Windows systems. The flaw arises from improper DLL path handling, specifically the use of LoadLibrary(TEXT('DLL_NAME')), which does not restrict paths to the System32 directory. If an attacker can place a malicious file in the installation directory of the affected software, they can execute arbitrary code. Yubico has released updated software versions to address this issue, which include libfido2 1.17.0, python-fido2 2.2.0, and yubikey-manager 5.9.1. The vulnerability has been assigned CVE-2026-40947 and carries a CVSS score of 7.0, indicating a high risk. While Yubico assesses the vulnerability as high risk, MITRE has classified it as low risk with a CVSS score of 2.9. Users are advised to update their software to mitigate the risk. No Yubico hardware is affected by this vulnerability. 2 sources 65

Extracted Entities

Platforms (3)

Python-fido2 Yubico Libfido2 Yubikey-manager