Threats affecting pkg:github/mcdope/pam_usb

CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.

A vulnerability in pam_usb versions prior to 0.9.1 causes the software to silently ignore permission errors when accessing input device nodes, leading to a false negative detection of virtual input devices. This results in the authentication process continuing without denial when it should not, potentially allowing unauthorized access. The issue is fixed in version 0.9.1.