CVE-2026-44711

Published: May 27, 2026Modified: Jun 17, 2026Deferred

7.9

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Exploitability: 1.5 / Impact: 5.8

Source: security-advisories@github.com (Secondary)

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

https://github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34

Source: security-advisories@github.com

https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.