PT-2026-44086 · Pam Usb · Pam Usb

Mcdope · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-47273

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.0

Description pam usb provides hardware authentication for Linux using removable media. The software builds XPath expressions to query /etc/pamusb.conf using identifiers supplied by the user (PAM username, service name) and the device (USB device serial, model, vendor). Because these identifiers are not validated for XPath metacharacters, it is possible to inject arbitrary XPath predicates. XPath injection is a technique where an attacker inserts malicious code into an XPath query to manipulate the data returned by the application.

Recommendations Update to version 0.9.0.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-47273

Affected Products

Pam Usb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47273 · Security Note
• https://github.com/mcdope/pam_usb/commit/721fed08a3596cb5b4671ad702f8fdc12dcc7420 · Note
• https://github.com/mcdope/pam_usb/pull/311 · Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-vfj3-5h5v-6g93 · Note
• https://t.me/CVEtracker/55169 · Telegram Post