CVE-2026-48792

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan, and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.

• CWE-390
• CWE-693

• https://github.com/mcdope/pam_usb/issues/351
• https://github.com/mcdope/pam_usb/issues/55
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-pvrg-chgw-x42c

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48783Postiz is an AI social media scheduling tool. Versions prior…4.8
• CVE-2026-48784Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5
• CVE-2026-48793Jellyfin is an open source self hosted media server. Prior t…8.8
• CVE-2026-48794Authelia is an open-source authentication and authorization …1.3
• CVE-2026-48795AdonisJS is a TypeScript-first web framework. From 10.1.3 un…8.6
• CVE-2026-48797Backpropagate is a Python library for fine-tuning large lang…9.3
• CVE-2026-48799Postiz is an AI social media scheduling tool. Prior to 2.21.…7.7
• CVE-2026-4880The Barcode Scanner (+Mobile App) – Inventory manager, Order…9.8