{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apam_usb_projectpam_usblinux/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pam_usb_project:pam_usb:*:*:*:*:*:linux:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-64669"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pam_usb (\u003e= 0.8.0, \u003c 0.9.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["pam_usb"],"content_html":"\u003cp\u003eThe pam_usb hardware authentication module contains a security flaw in the \u003ccode\u003edeny_remote\u003c/code\u003e feature, tracked as CVE-2026-64669. The vulnerability exists within \u003ccode\u003epusb_tmux_has_remote_clients()\u003c/code\u003e in \u003ccode\u003esrc/tmux.c\u003c/code\u003e, where an overly restrictive IPv6 regex fails to identify compressed IPv6 addresses. When a user connects to a remote tmux session using a compressed address (e.g., \u003ccode\u003e::1\u003c/code\u003e or \u003ccode\u003e2001:db8::1\u003c/code\u003e), the module fails to detect the remote presence and treats the session as local, effectively bypassing the \u003ccode\u003edeny_remote\u003c/code\u003e policy. This vulnerability affects pam_usb versions 0.8.0 through 0.9.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a user to bypass intended security policy restrictions that are designed to block authentication when a remote tmux session is active, potentially granting unauthorized access to the system via the hardware token if the remote session is active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the pam_usb module to version 0.9.3 or later on all affected Linux systems.\u003c/li\u003e\n\u003cli\u003eAudit PAM configuration files to determine if the \u003ccode\u003edeny_remote\u003c/code\u003e option is enabled, as the vulnerability only impacts systems utilizing this specific configuration.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for systems where hardware-based authentication is the primary barrier for remote-accessible accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:58:14Z","date_published":"2026-11-11T13:58:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/","summary":"The pam_usb module incorrectly evaluates remote tmux sessions due to a faulty IPv6 regex, allowing authentication when the deny_remote feature should be triggered.","title":"pam_usb: Authentication policy bypass via IPv6 (CVE-2026-64669)","url":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pam_usb_project:pam_usb:*:*:*:*:*:linux:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-64668"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pam_usb (\u003c 0.9.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA logical flaw exists in the 'deny_remote' feature of pam_usb versions 0.8.0 to 0.9.2. The module checks for active remote tmux sessions by executing \u003ccode\u003e/usr/bin/w -i\u003c/code\u003e. On multi-homed Linux systems, this command appends a zone index to link-local IPv6 addresses (e.g., \u003ccode\u003efe80::1%eth0\u003c/code\u003e). The regex used in \u003ccode\u003epusb_tmux_has_remote_clients()\u003c/code\u003e expects whitespace immediately after the IP address and fails to account for the suffix. Consequently, the function erroneously concludes no remote clients are active, bypassing intended access restrictions. This is patched in version 0.9.3.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized authentication on systems configured to use pam_usb with the 'deny_remote' feature enabled, specifically when the environment utilizes multi-homed network interfaces and IPv6 link-local addresses.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the pam_usb authentication module to version 0.9.3 or later on all affected Linux systems.\u003c/li\u003e\n\u003cli\u003eAudit PAM configurations to determine if \u003ccode\u003edeny_remote\u003c/code\u003e is active for pam_usb.\u003c/li\u003e\n\u003cli\u003eInventory Linux systems utilizing pam_usb for hardware-based authentication.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:58:08Z","date_published":"2026-11-11T13:58:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/","summary":"The pam_usb authentication module version 0.8.0 through 0.9.2 fails to correctly parse link-local IPv6 addresses with zone indices, leading to an authentication bypass in the deny_remote feature.","title":"pam_usb: Authentication bypass in deny_remote feature (CVE-2026-64668)","url":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pam_usb_project:pam_usb:*:*:*:*:*:linux:*:*","version":"https://jsonfeed.org/version/1.1"}