CVE-2026-44711: high-severity vulnerability in mcdope pam_usb
pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.9epss 0.2%
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Affected products
mcdope · pam_usbpublic PoCs found — 1
cve_referencegithub.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — mcdope pam_usb
In the same product, most dangerous first.
CVE-2026-64669HIGHpam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clientsEPSS 0.4%CVE-2026-64668HIGHpam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clientsEPSS 0.4%CVE-2026-48064HIGHpam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypassEPSS 0.3%CVE-2026-47269HIGHpam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localEPSS 0.3%CVE-2026-47273MEDIUMpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesEPSS 0.3%CVE-2026-64666HIGHpam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unsetEPSS 0.2%