CVE-2026-48981

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.

• CWE-611

• https://github.com/mcdope/pam_usb/releases/tag/0.9.2
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-96vv-r4wc-28c2

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48972Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2026-48973Missing Authorization vulnerability in Benbodhi SVG Support …4.3
• CVE-2026-48978oras-go is a Go library for managing OCI artifacts. Prior to…2.1
• CVE-2026-48979PHP Standard Library (PSL) is set of APIs covering async, co…7.5
• CVE-2026-4898A vulnerability was identified in code-projects Online Food …4.3
• CVE-2026-48980pam_usb provides hardware authentication for Linux using rem…6.3
• CVE-2026-48982pam_usb provides hardware authentication for Linux using ord…5.8
• CVE-2026-48983pam_usb provides hardware authentication for Linux using ord…5.8
• CVE-2026-48984pam_usb provides hardware authentication for Linux using ord…4.7
• CVE-2026-48985pam_usb provides hardware authentication for Linux using ord…5.5
• CVE-2026-48986pam_usb provides hardware authentication for Linux using rem…4.7
• CVE-2026-48988markdown-it is a Markdown parser. Versions 14.1.1 and below …5.3