Cisco Duo
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Cisco Duo.
Recent Cisco Duo Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2025-08-20 | Cisco Duo Authentication Proxy Information Disclosure Vulnerability | August 20, 2025 |
| 2025-05-21 | Cisco Duo Self-Service Portal Command Injection Vulnerability | May 21, 2025 |
| 2024-09-04 | Cisco Duo Epic for Hyperdrive Information Disclosure Vulnerability | September 4, 2024 |
| 2024-03-06 | Cisco Duo Authentication for Windows Logon and RDP Authentication Bypass Vulnerability | March 6, 2024 |
| 2024-03-06 | Cisco Duo Authentication for Windows Logon and RDP Information Disclosure Vulnerability | March 6, 2024 |
| 2023-08-16 | Cisco Duo Device Health Application for Windows Arbitrary File Write Vulnerability | August 16, 2023 |
| 2023-07-07 | Cisco Duo Authentication Proxy Information Disclosure Vulnerability | July 7, 2023 |
| 2023-06-21 | Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability | June 21, 2023 |
| 2023-04-05 | Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay Vulnerability | April 5, 2023 |
| 2022-09-28 | Cisco Duo for macOS Authentication Bypass Vulnerability | September 28, 2022 |
By the Year
In 2026 there have been 0 vulnerabilities in Cisco Duo. Last year, in 2025 Duo had 1 security vulnerability published. Right now, Duo is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 5.40 |
| 2024 | 0 | 0.00 |
| 2023 | 2 | 5.60 |
| 2022 | 1 | 6.80 |
It may take a day or so for new Duo vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cisco Duo Security Vulnerabilities
Cmd Injection in Cisco Duo Self-Service Portal Emails
CVE-2025-20258
5.4 - Medium
- May 21, 2025
A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands into a portion of an email that is sent by the service. A successful exploit could allow the attacker to send emails that contain malicious content to unsuspecting users.
Command Injection
MacOS Duo MFA Bypass via Fail-Open Config
CVE-2023-20199
6.6 - Medium
- June 28, 2023
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisco Duo when the application is configured to fail open. An attacker with primary user credentials could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the affected device without valid permission.
Cisco Duo MFA Replay Vulnerability (CVE-2023-20123)
CVE-2023-20123
4.6 - Medium
- April 05, 2023
A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows device. This vulnerability exists because session credentials do not properly expire. An attacker could exploit this vulnerability by replaying previously used multifactor authentication (MFA) codes to bypass MFA protection. A successful exploit could allow the attacker to gain unauthorized access to the affected device.
Authentication Bypass by Capture-replay
Cisco Duo macOS Smart Card Auth Bypass via PIV Mismatch
CVE-2022-20662
6.8 - Medium
- September 30, 2022
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.
authentification
