CVE-2026-64666

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64666
Aliases
  • GHSA-ffx6-xjp6-x33g
Published
2026-11-11T03:51:12Z
Modified
2026-11-12T07:04:18Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset
Details

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64666.json"
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9993723a2836c7de547ea380af521ed5f5b51651
Fixed
0b179ed679d6522c6a571c5a8ae9bdc7edbad31f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.9.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "0.9.3",
            "range": [
                {
                    "fixed": "9993723a2836c7de547ea380af521ed5f5b51651"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.5.0
0.7.1
0.7.2
0.7.3
0.8.3
0.8.4
0.8.7
0.9.0
0.9.1
0.9.2
v0.*
v0.7.0
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64666.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "42270652612144728068523263023684395714",
                "92467262262306267519026642740662417934",
                "136782600835749259801837679986067777916",
                "273731649055318298262137346772523162547"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64666-01990f6d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "src/local.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133439812045745079013501280075371764743",
            "length": 1480
        },
        "id": "CVE-2026-64666-055fb089",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "tests/unit/c/rmsvc_test.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "231405346607090920517833426756054086003",
                "6045695730409339658194645990711030597",
                "258082933734874322488679539105203474029",
                "34572357629708387945903035503027242653"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64666-b3158470",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "src/rmsvc.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36794390175406245867292998272605640075",
                "14118454235760970111291989330535841498",
                "211018580476455854709578939467476225161",
                "39299462975724824209930210508555015494",
                "122664819363403932015733268923585587484",
                "44657392357987321750895668504181055926",
                "74769738928314161455279710513359181321",
                "54243322391067484490214702115549818460",
                "254630237333706933239479628105520326228",
                "48514781077716934488093229789992329726"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64666-dbc1b0e9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "tests/unit/c/rmsvc_test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "1152070341827645579688263229015029717",
            "length": 1737
        },
        "id": "CVE-2026-64666-e778a259",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "src/rmsvc.c",
            "function": "pusb_has_active_remote_service"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "179079310922853850209356044249202837185",
            "length": 4589
        },
        "id": "CVE-2026-64666-eb74e21e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f",
        "target": {
            "file": "src/local.c",
            "function": "pusb_local_login"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "196826471672966929406198729402906788408"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64666-fc51f96e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/9993723a2836c7de547ea380af521ed5f5b51651",
        "target": {
            "file": "src/version.h"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:04:18Z"