CVE-2026-47269: CWE-284: Improper Access Control in mcdope pam_usb
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local.deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.
AI Analysis
Technical Summary
pam_usb is a Linux PAM module that provides hardware authentication using removable media. Before version 0.9.0, its deny_remote feature attempts to block authentication requests from remote sessions by checking the utmpx ut_addr_v6 field. The check only tests the first 32-bit word of the 128-bit IPv6 address, which fails to detect IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) because the first word is zero in these cases. On systems where SSH listens on all interfaces using IPv6 wildcard (::) and AddressFamily any, incoming IPv4 connections are recorded as IPv4-mapped IPv6 addresses. Consequently, the deny_remote check is bypassed, treating remote SSH sessions as local. An attacker with physical access to a registered USB device can exploit this to authenticate remotely over SSH, circumventing the deny_remote restriction. This vulnerability is resolved in pam_usb version 0.9.0.
Potential Impact
An attacker with physical access to a registered USB authentication device can remotely authenticate over SSH on affected systems as if they were local users, bypassing the deny_remote access control. This leads to unauthorized remote access with potentially high confidentiality and integrity impact. Availability is not affected. The CVSS 3.1 score is 7.4 (High), reflecting network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.
Mitigation Recommendations
This vulnerability is fixed in pam_usb version 0.9.0. Users should upgrade to version 0.9.0 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on applying the updated software. Patch status is confirmed fixed in version 0.9.0.
CVE-2026-47269: CWE-284: Improper Access Control in mcdope pam_usb
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local.deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
pam_usb is a Linux PAM module that provides hardware authentication using removable media. Before version 0.9.0, its deny_remote feature attempts to block authentication requests from remote sessions by checking the utmpx ut_addr_v6 field. The check only tests the first 32-bit word of the 128-bit IPv6 address, which fails to detect IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) because the first word is zero in these cases. On systems where SSH listens on all interfaces using IPv6 wildcard (::) and AddressFamily any, incoming IPv4 connections are recorded as IPv4-mapped IPv6 addresses. Consequently, the deny_remote check is bypassed, treating remote SSH sessions as local. An attacker with physical access to a registered USB device can exploit this to authenticate remotely over SSH, circumventing the deny_remote restriction. This vulnerability is resolved in pam_usb version 0.9.0.
Potential Impact
An attacker with physical access to a registered USB authentication device can remotely authenticate over SSH on affected systems as if they were local users, bypassing the deny_remote access control. This leads to unauthorized remote access with potentially high confidentiality and integrity impact. Availability is not affected. The CVSS 3.1 score is 7.4 (High), reflecting network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.
Mitigation Recommendations
This vulnerability is fixed in pam_usb version 0.9.0. Users should upgrade to version 0.9.0 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on applying the updated software. Patch status is confirmed fixed in version 0.9.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T23:03:37.229Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a175c27e29bf47b50eb609d
Added to database: 05/27/2026, 21:03:35 UTC
Last enriched: 05/27/2026, 21:33:27 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.