pam_usb: Authentication bypass via insecure environment variable handling (CVE-2026-64666)
The pam_usb module (prior to 0.9.3) incorrectly uses getenv() instead of secure_getenv() when checking the XRDP_SESSION variable in setuid contexts, enabling attackers to bypass XRDP-related authentication denials.
CVE search metadata
CVE search record: CVE-2026-64666. Severity: high. CVSS: 7.1. KEV: no. Product: pam_usb (< 0.9.3). Brief: pam_usb: Authentication bypass via insecure environment variable handling (CVE-2026-64666). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64666/
Triage facts
Revision 1- Applicability
- pam_usb (< 0.9.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
In versions prior to 0.9.3, pam_usb uses getenv(3) to retrieve the XRDP_SESSION variable in src/local.c. When pam_usb.so loads into a setuid PAM host, a user can control the environment, allowing them to clear the XRDP_SESSION variable and defeat the module's explicit XRDP-deny rule. Other remote-detection signals such as rmsvc, evdev, loginctl, and utmp may still catch the session. This issue has been patched in version 0.9.3.