Vulnerabilities/CVE-2026-44711

CVE-2026-44711: pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

SSVC decisionAttendEscalate and remediate ahead of routine patching.

ExploitationPoC

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

Source: CISA-ADP, SSVC v2.0.3As of 28-05-2026 12:46 UTCCISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Deferred

Published 27-05-2026Last modified 28-05-2026

On this page

Summary Advisory lineage Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published27-05-2026

Modified28-05-2026

SourceCVE.org

CVSS7.9

EPSS0.21%

KEV0

Exploits1

Vulnerability summary

CVE-2026-44711 is a high (CVSS 7.9) Link Following vulnerability in mcdope pam_usb. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

42/100

0100

Medium · default modelHow is this calculated?

SSVC decisionAttendEscalate and remediate ahead of routine patching.

ExploitationPoC

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

CVSS score

7.9/10

010

High · v3.1 (CVE.org)

EPSS score

0.21%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CVE-2026-45152

Timeline

27-05-2026
PublishedVulnerability first disclosed.
28-05-2026
Last modifiedVulnerability information updated.

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

CVSS metrics

2 scores · 2 sources · 1 version

v3.17.9

High 7.9Preferred score · CVE.org (CNA)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

SourcesAll 2 agree

NVDNIST7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 0.17% on 22-09-2026

100%75%50%25%0%

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Cli
Maturity: poc

Weaknesses

CWE · root cause

CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected systems

Mcdope1 product

pam_usb< 0.8.7

1 vendor · 1 product

References

2 links

github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34X Refsource CONFIRM
github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5Exploit

Related vulnerabilities

MediumCVE-2026-47274mcdope · pam_usb4mo agopam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulationpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.EPSS0.18%HighCVE-2026-47272mcdope · pam_usb4mo agopam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG bufferpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and readable. If the user-side pad was deleted or unreadable, the function returned a failure that was treated as non-fatal in certain code paths, allowing authentication to succeed without the USB device being verified. A local user can delete their own ~/.pamusb/device.pad to remove the USB device requirement and authenticate without the physical device. This vulnerability is fixed in 0.9.0.EPSS0.17%MediumCVE-2026-47273mcdope · pam_usb4mo agopam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriespam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.EPSS0.41%MediumCVE-2026-47271mcdope · pam_usb4mo agopam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crashpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0.EPSS0.16%HighCVE-2026-47269mcdope · pam_usb4mo agopam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.EPSS0.45%MediumCVE-2026-47270mcdope · pam_usb4mo agopam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resultpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.EPSS0.13%

All vulnerabilities inpam_usb