CVE-2026-48982

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open() without the O_EXCL flag. Without O_EXCL, the create operation is not atomic: two concurrent processes racing to update the same pad may both succeed in opening the file, with the second write silently overwriting the first. The one-time pad is the core replay-prevention mechanism of pam_usb. A successful race could result in the stored pad value diverging from what either process expected, potentially causing authentication failures or, in a precisely timed attack, creating a window for pad reuse. This issue has been fixed in version 0.9.2.

• CWE-362

• https://github.com/mcdope/pam_usb/releases/tag/0.9.2
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-hxh6-9574-5vp6

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48973Missing Authorization vulnerability in Benbodhi SVG Support …4.3
• CVE-2026-48978oras-go is a Go library for managing OCI artifacts. Prior to…2.1
• CVE-2026-48979PHP Standard Library (PSL) is set of APIs covering async, co…7.5
• CVE-2026-4898A vulnerability was identified in code-projects Online Food …4.3
• CVE-2026-48980pam_usb provides hardware authentication for Linux using rem…6.3
• CVE-2026-48981pam_usb provides hardware authentication for Linux using ord…6.7
• CVE-2026-48983pam_usb provides hardware authentication for Linux using ord…5.8
• CVE-2026-48984pam_usb provides hardware authentication for Linux using ord…4.7
• CVE-2026-48985pam_usb provides hardware authentication for Linux using ord…5.5
• CVE-2026-48986pam_usb provides hardware authentication for Linux using rem…4.7
• CVE-2026-48988markdown-it is a Markdown parser. Versions 14.1.1 and below …5.3
• CVE-2026-48989Windows-MCP is an open-source project that integrates AI age…8.9