CVE-2026-47272 pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer
A local attacker can bypass USB hardware authentication by deleting their user-side pad file, allowing login without the physical device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47272?
CVE-2026-47272 is a high-severity authentication bypass vulnerability in mcdope pam_usb, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and readable. If the user-side pad was deleted or unreadable, the function returned a failure that was treated as non-fatal in certain code paths, allowing authentication to succeed without the USB device being verified. A local user can delete their own ~/.pamusb/device.pad to remove the USB device requirement and authenticate without the physical device. This vulnerability is fixed in 0.9.0.
Which versions are affected by CVE-2026-47272?
How do I fix CVE-2026-47272?
No fix has been published for CVE-2026-47272 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-47272 being exploited?
There is no known exploitation of CVE-2026-47272 in the wild and no public exploit code.
Sources
Also known as GHSA-vx6f-rrqr-j87c.