CVE-2026-47272: pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer

Vulnerability summary

CVE-2026-47272 is a high (CVSS 7.1) Improper Authentication vulnerability in mcdope pam_usb. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.3% of scored vulnerabilities.

Timeline

1. 27-05-2026
   PublishedVulnerability first disclosed.
2. 28-05-2026
   Last modifiedVulnerability information updated.

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and readable. If the user-side pad was deleted or unreadable, the function returned a failure that was treated as non-fatal in certain code paths, allowing authentication to succeed without the USB device being verified. A local user can delete their own ~/.pamusb/device.pad to remove the USB device requirement and authenticate without the physical device. This vulnerability is fixed in 0.9.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.