A flaw in Yubico libfido2 before version 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 allows an attacker to influence the DLL search path used by these authentication libraries. The libraries accept a search path that can be manipulated so that a malicious DLL placed in that location could be loaded and executed with the privileges of the running process. This vulnerability is classified as CWE‑426, which covers DLL search order hijacking.

Affected by Yubico, the following packages are impacted when used below the specified versions: libfido2 (versions < 1.17.0), python-fido2 (versions < 2.2.0), and yubikey-manager (versions < 5.9.1). All newer releases contain the fix and are not affected.

The CVSS score of 2.9 indicates a low overall severity. The exploit probability score is not available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no widespread exploitation is currently known. The likely attack vector is local or user‑initiated; an attacker would need to supply a crafted DLL path or otherwise influence the application’s environment for the malicious DLL to be loaded. If executed, the code runs with the privileges of the calling process, which could lead to local code execution or privilege escalation if the process runs as a privileged user.