{"affected":[{"product":"pam_usb","source":"CNA: GitHub_M","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"cveId":"CVE-2026-64666","cwes":["CWE-807"],"description":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794369072232,"publishedAt":1794369072232,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mcdope/pam_usb/issues/410"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mcdope/pam_usb/pull/417"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"}],"remediation":[],"revision":"386ad73f440855b5205d7a9917687bf2ee3f9b85f5ca67d60f73a8bec9eccc1b","sources":[{"modifiedAt":1794369072232,"name":"CNA: GitHub_M","retrievedAt":1794370175389,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64666"}],"ssvc":null,"status":"published","title":"pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset","updatedAt":1794370175389}