The pam_usb module for Linux hardware authentication constructs XPath expressions from unvalidated user-supplied (PAM username, service name) and device-supplied (USB device serial, model, vendor) identifiers to query its configuration file. Prior to version 0.9.0, these inputs were not sanitized for XPath metacharacters, enabling an attacker to inject arbitrary XPath predicates, classified as CWE-91 (XML Injection). This could lead to unauthorized information disclosure or authentication bypass. The issue is resolved in pam_usb version 0.9.0.

Exploitation of this vulnerability could allow an unauthenticated attacker to manipulate XPath queries used for authentication, potentially bypassing authentication controls or accessing unauthorized information. The CVSS vector indicates network attack vector with high attack complexity and no privileges or user interaction required, with low confidentiality impact but high integrity impact and no availability impact.

Upgrade pam_usb to version 0.9.0 or later, where this XML Injection vulnerability is fixed. Since no official patch link or vendor advisory is provided, verify the upgrade from the official mcdope project sources. Patch status is not explicitly confirmed beyond the version fix note; check vendor sources for current remediation guidance.