pam_usb: Authentication bypass via getenv() in XRDP session check
Summary
pam_usb, a PAM module for hardware authentication with removable media on Linux, reads the XRDP_SESSION environment variable with getenv() instead of secure_getenv() in its local login path. When loaded into a setuid PAM host such as login, su or sudo, a local user can clear this variable before the host runs, which defeats the explicit deny rule for XRDP sessions. Other remote-detection signals may still detect the session, so the weakening is partial. Exploitation requires a local account on the host.
Affected
- mcdope pam_usb versions prior to 0.9.3
- Hosts where pam_usb is used in PAM stacks and XRDP is in use
- Note: the CVE record and VulDB differ on the exact range (VulDB: up to 0.9.2) and on the CVSS score and CWE; the CNA record (CVSS 7.1, CWE-807) is used here
Fixed in
- Upgrade to pam_usb 0.9.3 or later
Workaround
- Unknown.
- If an immediate upgrade is not possible, check whether pam_usb is needed on hosts with XRDP enabled and remove it from PAM stacks where it is not required.
Exploitation
- Not known to be exploited.
- No public exploit code known at the time of research.
- Not listed in CISA KEV as of 11 Nov 2026.
Our recommendation
- Identify hosts with pam_usb installed and XRDP enabled.
- Upgrade pam_usb to version 0.9.3 or later.
- Until the upgrade is done, restrict local accounts on affected hosts and review whether pam_usb is required there.
- Monitor authentication logs for unusual sudo or login activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub advisory GHSA-ffx6-xjp6-x33g github.com
- Fix commit 0b179ed github.com
- Pull request #417 github.com
- Issue #410 github.com
- Release 0.9.3 github.com
- NVD / Vulners record CVE-2026-64666 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:01.
Original description (NVD)
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.
NVD references (5)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.