microsoft / microsoft/winget-pkgs

[Package Issue]: Yubico.YubiKeyPersonalizationTool is EOL and affected by CVE-2026-40947 - suggest to the user to replace it?

Open
#373,556 3 comments 0 reactions 0 assignees View on GitHub
Issue-Bug Needs-Triage
Dominant language
No language data
Stars
11.1k
Forks
9.7k
PR merge metrics
PR metrics pending

Description

### Please confirm these before moving forward

- [x] I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
- [x] I have not been informed if the issue is resolved in a preview version of the winget client.

### Category of the issue

Other

### Brief description of your issue

https://www.yubico.com/support/terms-conditions/yubico-end-of-life-policy/eol-products/

scroll down to Software products ... suggested CLI-based app for replacement is Yubico.YubiKeyManagerCLI and (my suggestion for) GUI-based app for replacement is Yubico.Authenticator (both also already available through WinGet).

**Please note that soon Yubico will start releasing keys based on firmware 5.8 and the EOL apps are likely to have errors when running with new firmware devices.**

Also see: https://www.yubico.com/support/security-advisories/ysa-2026-01/
https://developers.yubico.com/yubikey-personalization-gui/
and CVE-2026-40947

Image

### Steps to reproduce

Use ancient Yubico apps.

### Actual behavior

EOL = no longer updated or tested for compatibility with new firmware devices, leading to potential errors.

### Expected behavior

expected: Management tools should have no errors when used with new firmware devices and also have the possibility to configure the new functions too.

### Environment

```raw
environment is not relevant - this is a WinGet supply chain issue. (winget keeps EOL software listed)
```

### Screenshots and Logs

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the Yubico.YubiKeyPersonalizationTool manifest in winget-pkgs and review the EOL and security-advisory links in the issue. Check repository guidance for handling EOL packages and determine whether the listing should be removed or updated to direct users toward Yubico.YubiKeyManagerCLI or Yubico.Authenticator. Done means the package's status and replacement guidance match the repository's accepted approach.

Written by the indexing model from the issue text.

Assessment

Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.