{"id":"CVE-2026-64666","published":"2026-11-11T05:19:50.700","lastModified":"2026-11-11T05:19:50.700","description":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-807"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","tags":[]},{"url":"https://github.com/mcdope/pam_usb/issues/410","tags":[]},{"url":"https://github.com/mcdope/pam_usb/pull/417","tags":[]},{"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3","tags":[]},{"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g","tags":[]}],"exploitRefs":[{"url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","tags":[]},{"url":"https://github.com/mcdope/pam_usb/issues/410","tags":[]},{"url":"https://github.com/mcdope/pam_usb/pull/417","tags":[]},{"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3","tags":[]},{"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g","tags":[]}],"hasPoc":true,"ai":null}