CVE-2022-24584

https://notcve.org/view.php?id=CVE-2022-24584

11 May 2022 — Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a sec... • https://demo.yubico.com/otp/verify • CWE-863: Incorrect Authorization •