CVE-2026-48980

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mcdope/pam_usb/releases/tag/0.9.2
https://github.com/mcdope/pam_usb/security/advisories/GHSA-qr83-mf3h-fvqr

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) pam_usb proporciona autenticación de hardware para Linux utilizando medios extraíbles. En versiones anteriores a la 0.9.2, las variables de entorno getenv() XRDP_SESSION, DISPLAY y TMUX permiten la inyección de variables de entorno en la lógica de verificación local. Estas variables de entorno influyen en si una sesión actual es local o remota, y un módulo PAM que se ejecuta en el contexto de binarios setuid (sudo, su), getenv() devuelve valores controlados por el atacante siempre que el entorno del proceso haya sido manipulado por un usuario local. Este problema ha sido solucionado en la versión 0.9.2.

Information

Published : 2026-06-18 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-48980

Mitre link : CVE-2026-48980

CVE.ORG link : CVE-2026-48980

JSON object : View

Products Affected

No product.

CWE

CWE-454

External Initialization of Trusted Variables or Data Stores

CWE-807

Reliance on Untrusted Inputs in a Security Decision

{"id": "CVE-2026-48980", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48980", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T20:25:21.713697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"status": "affected", "version": "< 0.9.2"}]}]}], "published": "2026-06-18T20:16:14.273", "references": [{"url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-qr83-mf3h-fvqr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-454"}, {"lang": "en", "value": "CWE-807"}]}], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2."}, {"lang": "es", "value": "pam_usb proporciona autenticaci\u00f3n de hardware para Linux utilizando medios extra\u00edbles. En versiones anteriores a la 0.9.2, las variables de entorno getenv() XRDP_SESSION, DISPLAY y TMUX permiten la inyecci\u00f3n de variables de entorno en la l\u00f3gica de verificaci\u00f3n local. Estas variables de entorno influyen en si una sesi\u00f3n actual es local o remota, y un m\u00f3dulo PAM que se ejecuta en el contexto de binarios setuid (sudo, su), getenv() devuelve valores controlados por el atacante siempre que el entorno del proceso haya sido manipulado por un usuario local. Este problema ha sido solucionado en la versi\u00f3n 0.9.2."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}