CVE-2026-40947 - Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path

LOW

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path

Published Apr 15, 2026

2.9

LOW

CVSS 3.1

EPSS 0.13%

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.

Vendor Yubico Product Libfido2 Default
unaffected
Affected
- ≥ 0, < 1.17.0
Vendor Yubico Product Python-Fido2 Default
unaffected
Affected
- ≥ 0, < 2.2.0
Vendor Yubico Product Yubikey-Manager Default
unaffected
Affected
- ≥ 0, < 5.9.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Yubico	Libfido2	unaffected	Affected ≥ 0, < 1.17.0
Yubico	Python-Fido2	unaffected	Affected ≥ 0, < 2.2.0
Yubico	Yubikey-Manager	unaffected	Affected ≥ 0, < 5.9.1