CVE-2026-47269

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47269
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47269.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47269
Aliases
  • GHSA-jmmj-qhrq-w45g
Published
2026-05-27T20:11:44Z
Modified
2026-08-12T16:09:39Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local
Details

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47269.json"
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
804fe24eae3d742d8be05fd015e36abc3c7d94e5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47269.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "193037768944057422419939619927610672606",
            "length": 1197
        },
        "id": "CVE-2026-47269-333ea212",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/804fe24eae3d742d8be05fd015e36abc3c7d94e5",
        "target": {
            "file": "src/local.c",
            "function": "pusb_is_tty_local"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "253154704975797875645984500599312628330",
                "191649508646307056564174506231220376710",
                "159091127102520086978722006132133249113",
                "334192888063606004618821418106347158964"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-47269-8bcbb116",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/804fe24eae3d742d8be05fd015e36abc3c7d94e5",
        "target": {
            "file": "src/local.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111734613024512688401843346597624792554",
                "32419240941865328615197713511651212359",
                "133292760351448666045639736902550407643",
                "186824676040192820982345094729142093606",
                "337045630319195637586760951569068277075",
                "321064616074521651917179242076711742811",
                "102993289771242624379100828068961033442",
                "175603995299463773467080808780259447995"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-47269-c12870c8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/804fe24eae3d742d8be05fd015e36abc3c7d94e5",
        "target": {
            "file": "src/device.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "131945397491401008104677786559519543925",
            "length": 2231
        },
        "id": "CVE-2026-47269-e6ee68c0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/804fe24eae3d742d8be05fd015e36abc3c7d94e5",
        "target": {
            "file": "src/device.c",
            "function": "pusb_device_connected"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:09:39Z"