CVE-2026-48792: medium-severity vulnerability in mcdope pam_usb
pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.1%
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan, and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
mcdope · pam_usbRelated CVEs — mcdope pam_usb
In the same product, most dangerous first.
CVE-2026-48064HIGHpam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypassEPSS 0.3%CVE-2026-47269HIGHpam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localEPSS 0.3%CVE-2026-47273MEDIUMpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesEPSS 0.3%CVE-2026-44711HIGHpam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruptionEPSS 0.2%CVE-2026-44710MEDIUMpam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-serviceEPSS 0.2%CVE-2026-48980MEDIUMpam_usb: getenv() used in PAM context allows environment variable injection into local-check logicEPSS 0.2%