CVE-2020-27743

libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.

• CWE-330

• https://github.com/kravietz/pam_tacplus/pull/163Third Party Advisory
• https://tools.ietf.org/html/rfc8907Technical Description, Third Party Advisory
• https://github.com/kravietz/pam_tacplus/pull/163Third Party Advisory
• https://tools.ietf.org/html/rfc8907Technical Description, Third Party Advisory

Published

Oct 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27738A vulnerability has been identified in APOGEE PXC Compact (B…7.4
• CVE-2020-27739A Weak Session Management vulnerability in Citadel WebCit th…9.8
• CVE-2020-2774Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-27740Citadel WebCit through 926 allows unauthenticated remote att…5.3
• CVE-2020-27741Multiple cross-site scripting (XSS) vulnerabilities in Citad…6.1
• CVE-2020-27742An Insecure Direct Object Reference vulnerability in Citadel…6.5
• CVE-2020-27744An issue was discovered on Western Digital My Cloud NAS devi…9.8
• CVE-2020-27745Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buff…9.8
• CVE-2020-27746Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensiti…3.7
• CVE-2020-27747An issue was discovered in Click Studios Passwordstate 8.9 (…6.8
• CVE-2020-27748A flaw was found in the xdg-email component of xdg-utils-1.1…6.5
• CVE-2020-27749A flaw was found in grub2 in versions prior to 2.06. Variabl…6.7