CVE-2026-47269

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.

• CWE-284

• https://github.com/mcdope/pam_usb/commit/804fe24eae3d742d8be05fd015e36abc3c7d94e5
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-jmmj-qhrq-w45g

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47263Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-47264Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-47265AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-47266Formie is a Craft CMS plugin for creating forms. Prior to 2.…8.7
• CVE-2026-47267Gogs is an open source self-hosted Git service. Prior to 0.1…8.3
• CVE-2026-47268Nezha Monitoring is a self-hostable, lightweight, servers an…6.4
• CVE-2026-4727Denial-of-service in the Libraries component in NSS. This vu…7.5
• CVE-2026-47270pam_usb provides hardware authentication for Linux using ord…6.3
• CVE-2026-47271pam_usb provides hardware authentication for Linux using ord…5.1
• CVE-2026-47272pam_usb provides hardware authentication for Linux using ord…7.1
• CVE-2026-47273pam_usb provides hardware authentication for Linux using ord…6.5
• CVE-2026-47274pam_usb provides hardware authentication for Linux using ord…6.3