Joey Castillo

**Name of the Vulnerable Software and Affected Versions** Yubico ykneo-openpgp versions prior to 1.0.10 **Description** The issue is caused by a typo, allowing an invalid PIN to be used. When the device is first powered up, a signature will be issued even though the PIN has not been validated. **Recommendations** For versions prior to 1.0.10, update to version 1.0.10 or later to resolve the issue. As a temporary workaround, consider disabling the use of the device until a patch is available. Restrict access to the device to minimize the risk of exploitation.