PT-2026-44088 · Mcdope · Pam Usb

Mcdope · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-48064

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

pam usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny remote=false in pam usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM RHOST check in pusb do auth() is also skipped. PAM RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-48064

Affected Products

Pam Usb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48064 · Security Note
• https://github.com/mcdope/pam_usb/issues/348 · Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-w38v-cw9r-x9p6 · Note