CVE-2026-47273 pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries
Attackers can inject XPath predicates via PAM identifiers to bypass hardware authentication, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47273?
CVE-2026-47273 is a medium-severity code injection vulnerability in mcdope pam_usb, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.
Weakness: CWE-91
Which versions are affected by CVE-2026-47273?
How do I fix CVE-2026-47273?
No fix has been published for CVE-2026-47273 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-47273 being exploited?
There is no known exploitation of CVE-2026-47273 in the wild and no public exploit code.
Sources
Also known as GHSA-vfj3-5h5v-6g93.