CVE-2026-48064: pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass

Vulnerability summary

CVE-2026-48064 is a high (CVSS 8.1) Incorrect Authorization vulnerability in mcdope pam_usb. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.

Timeline

1. 27-05-2026
   PublishedVulnerability first disclosed.
2. 02-06-2026
   Last modifiedVulnerability information updated.

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.