{"id":"CVE-2026-64666","kind":"vulnerability","aliases":["CVE-2026-64666"],"related":[],"title":"pam_usb: remote-session check can be bypassed via environment variable","description":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.","summary":"pam_usb is a PAM module that lets removable USB media authenticate Linux logins. Before 0.9.3, it reads the XRDP_SESSION environment variable with plain getenv, so a calling user can clear it in a setuid PAM host and skip the rule that denies USB login over remote desktop.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","pam","self-hosted","xrdp"],"not_affected_if":["no-xrdp-deny-rule","pam-usb-not-installed","patched-0.9.3"],"how_to_check":"- Check the installed version: `pam_usb` package version, or confirm `pam_usb.so` is present in your PAM modules directory\n- Look for `pam_usb.so` in PAM configuration files such as `/etc/pam.d/` to see whether it is used by a setuid PAM host\n- Check whether xrdp is used on the machine, since the bypass targets the XRDP-deny rule","fix":"- pam_usb: move to version `0.9.3` or later (the patched release named in the description)","status":"open","published_at":"2026-11-11T05:19:50+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","triaged_at":"2026-11-11T05:26:39+00:00","updated_at":"2026-11-11T05:26:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T05:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- pam_usb: move to version `0.9.3` or later (the patched release named in the description)","reach":"local","title":"pam_usb: remote-session check can be bypassed via environment variable","impact":"medium","summary":"pam_usb is a PAM module that lets removable USB media authenticate Linux logins. Before 0.9.3, it reads the XRDP_SESSION environment variable with plain getenv, so a calling user can clear it in a setuid PAM host and skip the rule that denies USB login over remote desktop.","audience":"businesses","category":"package","nicknames":[],"who_cares":["linux","pam","xrdp","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user bypasses remote-session denial for USB login","analyst_note":"","how_to_check":"- Check the installed version: `pam_usb` package version, or confirm `pam_usb.so` is present in your PAM modules directory\n- Look for `pam_usb.so` in PAM configuration files such as `/etc/pam.d/` to see whether it is used by a setuid PAM host\n- Check whether xrdp is used on the machine, since the bypass targets the XRDP-deny rule","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pam-usb-not-installed","no-xrdp-deny-rule","patched-0.9.3"],"who_is_affected":"Systems where pam_usb is installed as a PAM module and used for login through a setuid PAM host, especially machines that accept remote desktop sessions through xrdp. Machines without pam_usb, or where it is not configured for login, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000781,"input_tokens":4706,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-64666':15A,18A '0.9.3':41B,88C,177C '3':96C,116C 'alon':167C 'authent':37B,79C 'base':165C 'bypass':9A,140C 'call':54B,126C 'catch':158C 'check':6A 'clear':57B,133C 'consum':108C 'control':128C 'cve':13A,16A 'defeat':169C 'deni':69B,145C 'desktop':74B 'detect':150C,166C 'env':107C,164C 'env-bas':163C 'environ':11A,47B,130C 'evdev':153C 'everi':105C 'explicit':142C 'function':112C 'getenv':51B,95C,115C 'hardwar':78C 'head':99C 'host':24B,63B,124C,139C 'invok':137C 'issu':171C 'let':33B 'linux':19B,38B,81C 'load':119C 'local':102C 'login':39B,71B,103C 'loginctl':154C 'may':156C 'media':36B,84C 'modul':31B 'packag':20B 'pam':1A,21B,26B,30B,62B,75C,123C 'pam_usb.so':118C 'pass':131C 'patch':174C 'plain':50B,94C 'prior':85C 'provid':77C 'pusb':101C 'read':43B,90C 'remot':4A,73B,149C 'remote-detect':148C 'remote-sess':3A 'remov':34B,83C 'rmsvc':152C 'rule':67B,146C 'secur':114C 'self':23B 'self-host':22B 'session':5A,46B,92C,135C,160C 'setuid':61B,122C 'signal':151C 'skip':65B 'src/local.c':89C 'still':157C 'usb':2A,27B,35B,70B,76C 'use':82C,113C 'user':55B,127C 'utmp':155C 'variabl':12A,48B 'version':87C,176C 'via':10A 'xrdp':25B,45B,91C,134C,144C 'xrdp-deni':143C","nicknames":[],"mitigations":[],"who_affected":"Systems where pam_usb is installed as a PAM module and used for login through a setuid PAM host, especially machines that accept remote desktop sessions through xrdp. Machines without pam_usb, or where it is not configured for login, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","package","pam","selfhosted","xrdp"],"campaign_type":null,"search_a":"'-2026':14A,17A '-64666':15A,18A 'bypass':9A 'check':6A 'cve':13A,16A 'environ':11A 'pam':1A 'remot':4A 'remote-sess':3A 'session':5A 'usb':2A 'variabl':12A 'via':10A","search_b":"'0.9.3':41B 'authent':37B 'call':54B 'clear':57B 'deni':69B 'desktop':74B 'environ':47B 'getenv':51B 'host':24B,63B 'let':33B 'linux':19B,38B 'login':39B,71B 'media':36B 'modul':31B 'packag':20B 'pam':21B,26B,30B,62B 'plain':50B 'read':43B 'remot':73B 'remov':34B 'rule':67B 'self':23B 'self-host':22B 'session':46B 'setuid':61B 'skip':65B 'usb':27B,35B,70B 'user':55B 'variabl':48B 'xrdp':25B,45B","search_c":"'0.9.3':88C,177C '3':96C,116C 'alon':167C 'authent':79C 'base':165C 'bypass':140C 'call':126C 'catch':158C 'clear':133C 'consum':108C 'control':128C 'defeat':169C 'deni':145C 'detect':150C,166C 'env':107C,164C 'env-bas':163C 'environ':130C 'evdev':153C 'everi':105C 'explicit':142C 'function':112C 'getenv':95C,115C 'hardwar':78C 'head':99C 'host':124C,139C 'invok':137C 'issu':171C 'linux':81C 'load':119C 'local':102C 'login':103C 'loginctl':154C 'may':156C 'media':84C 'pam':75C,123C 'pam_usb.so':118C 'pass':131C 'patch':174C 'plain':94C 'prior':85C 'provid':77C 'pusb':101C 'read':90C 'remot':149C 'remote-detect':148C 'remov':83C 'rmsvc':152C 'rule':146C 'secur':114C 'session':92C,135C,160C 'setuid':122C 'signal':151C 'src/local.c':89C 'still':157C 'usb':76C 'use':82C,113C 'user':127C 'utmp':155C 'version':87C,176C 'xrdp':91C,134C,144C 'xrdp-deni':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T15:04:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64666","severity":null,"published_at":"2026-11-11T05:19:50+00:00","modified_at":"2026-11-11T05:19:50+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","fetched_at":"2026-11-11T05:25:39+00:00","note":null}],"documents":[{"id":122859,"url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122860,"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122861,"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T15:04:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}