Yubico/yubico-pam — pull request #9 by Feandil (2012-04-20 18:05:40+00:00)
Title: Unvalidated user-input

There is no validation of the OTP part in the yubico-pam module.
This allow an attacker to mess a little with the request sent (I briefly read the ykclient code and saw no validation) by adding '&' for example.

This is a little patch that fixes it by verifying that the OTP is only composed of modhex characters before transmitting it to the ykclient?