CVE-2026-64666— pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

Quick assessment

Affected

mcdope pam_usb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pam_usb 利用可移动介质为 Linux 系统提供硬件认证功能。在 0.9.3 版本之前，文件中的函数在开头处使用普通的读取环境变量，而该函数中所有其他环境变量的读取均使用了更安全的。当模块被加载到具有 setuid 权限的 PAM 主机时，调用者（即当前用户）可以控制传入的环境变量。通过在调用主机之前清除变量，即可绕过显式的 XRDP 拒绝规则。虽然其他远程会话检测信号（如、、和）仍可能识别该会话，但仅依赖环境变量的检测机制已被攻破。该问题已在 0.9.3 版本中修复。

CVSS 7.1 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1548.002 · Bypass User Account Control

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

Source: CVE Program / CVE List V5

Vulnerability Description

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在安全决策中依赖未经信任的输入

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mcdope	pam_usb	< 0.9.3	-

II. Public POCs for CVE-2026-64666

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64666

请登录查看更多情报信息。

Other References for CVE-2026-64666 (5)

https://github.com/mcdope/pam_usb/pull/417 x_refsource_MISC
https://github.com/mcdope/pam_usb/issues/410 x_refsource_MISC
https://github.com/mcdope/pam_usb/releases/tag/0.9.3 x_refsource_MISC
https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g x_refsource_CONFIRM
https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-64666

Same Patch Batch · mcdope · 2026-11-11 · 4 CVEs total

CVE-2026-64668	7.4 HIGH	pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_h
CVE-2026-64669	7.4 HIGH	pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
CVE-2026-64667	4.4 MEDIUM	pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan

IV. Related Vulnerabilities

Same product: pam_usb

Same vendor: mcdope

Same weakness: CWE-807