CVE-2026-48064

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48064
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48064.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48064
Aliases
  • GHSA-w38v-cw9r-x9p6
Published
2026-05-27T19:59:53.496Z
Modified
2026-07-15T23:39:34.634583Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass
Details

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with denyremote=false in pamusb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAMRHOST check in pusbdoauth() is also skipped. PAMRHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.denyremote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48064.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e2f30b22cd0715fcde0fc62d6ee3e1ca6370b8a9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.5.0
0.7.1
0.7.2
0.7.3
0.8.3
0.8.4
0.8.7
0.9.0
v0.*
v0.7.0
v0.8.0

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/mcdope/pam_usb/commit/e2f30b22cd0715fcde0fc62d6ee3e1ca6370b8a9",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "32897324108646938673138056869665931337"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-48064-b792a2ae",
        "target": {
            "file": "src/version.h"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T23:39:34Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48064.json"