CVE-2026-40947
Low
Description
Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.
SeverityLow
CVSS2.9
Exploit probability—
ProductYubico Libfido2
PublishedApr 16, 2026
First seenApr 16, 2026
Weakness typeCWE-426CWE-426
How to fix
Update
- Yubico libfido21.17.0 or later
- Yubico python-fido22.2.0 or later
- Yubico yubikey-manager5.9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Yubico libfido2 | v < 1.17.0 | 1.17.0 |
| Yubico python-fido2 | v < 2.2.0 | 2.2.0 |
| Yubico yubikey-manager | v < 5.9.1 | 5.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.