CVE-2026-48064 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass
Attackers can bypass remote authentication checks in pam_usb when deny_remote is disabled, allowing unauthorized access via XDMCP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48064?
CVE-2026-48064 is a high-severity authentication bypass vulnerability in mcdope pam_usb, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-48064?
How do I fix CVE-2026-48064?
No fix has been published for CVE-2026-48064 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-48064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48064 exists.
Sources
Also known as GHSA-w38v-cw9r-x9p6.