CVE-2026-40947

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path...

aws-assume (>=0.1.0, <=0.2.3), aws-credential-process (>=0.1.0, <=0.20.0) +6 more potentially affected by CVE-2026-40947 via yubikey-manager (>=2.0.0, <=5.1.1)

yubikey-manager PYPI version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =1.1.0, =1.0.0, =0.1.0, =0.1.3 - yubikey-unlock-session 0.1.0 Source cves: CVE-2026-40947 Source advisory: MEND:CVE-2026-40947...

CVE-2026-40947

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path...

CVE-2026-40947

Affected software components are Yubico libfido2 (before 1.17.0), python-fido2 (before 2.2.0), and yubikey-manager (before 5.9.1). The issue is an unintended DLL search path, as described in CVE-2026-40947. The CVSS vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, with a base score of 2.9 ...