---
id: "CVE-2026-64666"
page: "https://infrastack.ai/live/CVE-2026-64666"
kind: "vulnerability"
aliases: ["CVE-2026-64666"]
title: "pam_usb: remote-session check can be bypassed via environment variable"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "package", "pam", "self-hosted", "xrdp"]
not_affected_if: ["no-xrdp-deny-rule", "pam-usb-not-installed", "patched-0.9.3"]
published_at: "2026-11-11T05:19:50+00:00"
first_seen_at: "2026-11-11T05:25:39+00:00"
updated_at: "2026-11-11T05:26:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64666", "first_seen_at": "2026-11-11T05:25:39+00:00"}]
exploit_sources: []
---

# pam_usb: remote-session check can be bypassed via environment variable

Link for people: https://infrastack.ai/live/CVE-2026-64666 (this .md is for agents)

pam_usb is a PAM module that lets removable USB media authenticate Linux logins. Before 0.9.3, it reads the XRDP_SESSION environment variable with plain getenv, so a calling user can clear it in a setuid PAM host and skip the rule that denies USB login over remote desktop.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version: `pam_usb` package version, or confirm `pam_usb.so` is present in your PAM modules directory
- Look for `pam_usb.so` in PAM configuration files such as `/etc/pam.d/` to see whether it is used by a setuid PAM host
- Check whether xrdp is used on the machine, since the bypass targets the XRDP-deny rule

## Fix

- pam_usb: move to version `0.9.3` or later (the patched release named in the description)

## Timeline

- 2026-11-11T05:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64666

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g
- [fix] Patch: github.com https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f
- [fix] Release notes: github.com https://github.com/mcdope/pam_usb/releases/tag/0.9.3

## From the sources

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_