CVE-2026-48064: CWE-863: Incorrect Authorization in mcdope pam_usb
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.
AI Analysis
Technical Summary
The vulnerability in pam_usb (before version 0.9.1) arises because the PAM_RHOST check in the pusb_do_auth() function is conditionally skipped when the deny_remote option is false. This option is commonly set to false for display managers like gdm-password or lightdm to allow local session authentication without process/TTY heuristics. However, this also inadvertently allows remote XDMCP connections to bypass the remote access denial and proceed to USB device authentication, resulting in incorrect authorization (CWE-863). The issue is resolved in pam_usb version 0.9.1.
Potential Impact
This vulnerability can allow an attacker connecting via remote XDMCP sessions to bypass intended remote access restrictions and authenticate using the USB device authentication mechanism. The CVSS 3.1 score of 8.1 indicates a high impact with network attack vector, high confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade pam_usb to version 0.9.1 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, users should verify the version in use and apply the update accordingly. Patch status is not yet confirmed via vendor advisory; check the vendor's official channels for the latest remediation guidance.
CVE-2026-48064: CWE-863: Incorrect Authorization in mcdope pam_usb
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in pam_usb (before version 0.9.1) arises because the PAM_RHOST check in the pusb_do_auth() function is conditionally skipped when the deny_remote option is false. This option is commonly set to false for display managers like gdm-password or lightdm to allow local session authentication without process/TTY heuristics. However, this also inadvertently allows remote XDMCP connections to bypass the remote access denial and proceed to USB device authentication, resulting in incorrect authorization (CWE-863). The issue is resolved in pam_usb version 0.9.1.
Potential Impact
This vulnerability can allow an attacker connecting via remote XDMCP sessions to bypass intended remote access restrictions and authenticate using the USB device authentication mechanism. The CVSS 3.1 score of 8.1 indicates a high impact with network attack vector, high confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade pam_usb to version 0.9.1 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, users should verify the version in use and apply the update accordingly. Patch status is not yet confirmed via vendor advisory; check the vendor's official channels for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.707Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a17519de29bf47b50e771b3
Added to database: 05/27/2026, 20:18:37 UTC
Last enriched: 06/04/2026, 20:22:19 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.