https://feed.craftedsignal.io/cpes/cpe2.3apam_usb_projectpam_usblinux/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:14 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/Wed, 11 Nov 2026 13:58:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/The pam_usb module incorrectly evaluates remote tmux sessions due to a faulty IPv6 regex, allowing authentication when the deny_remote feature should be triggered.The pam_usb hardware authentication module contains a security flaw in the deny_remote feature, tracked as CVE-2026-64669. The vulnerability exists within pusb_tmux_has_remote_clients() in src/tmux.c, where an overly restrictive IPv6 regex fails to identify compressed IPv6 addresses. When a user connects to a remote tmux session using a compressed address (e.g., ::1 or 2001:db8::1), the module fails to detect the remote presence and treats the session as local, effectively bypassing the deny_remote policy. This vulnerability affects pam_usb versions 0.8.0 through 0.9.2.

Impact

Successful exploitation allows a user to bypass intended security policy restrictions that are designed to block authentication when a remote tmux session is active, potentially granting unauthorized access to the system via the hardware token if the remote session is active.

Recommendation

• Upgrade the pam_usb module to version 0.9.3 or later on all affected Linux systems.
• Audit PAM configuration files to determine if the deny_remote option is enabled, as the vulnerability only impacts systems utilizing this specific configuration.
• Prioritize patching for systems where hardware-based authentication is the primary barrier for remote-accessible accounts.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/Wed, 11 Nov 2026 13:58:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/The pam_usb authentication module version 0.8.0 through 0.9.2 fails to correctly parse link-local IPv6 addresses with zone indices, leading to an authentication bypass in the deny_remote feature.A logical flaw exists in the 'deny_remote' feature of pam_usb versions 0.8.0 to 0.9.2. The module checks for active remote tmux sessions by executing /usr/bin/w -i. On multi-homed Linux systems, this command appends a zone index to link-local IPv6 addresses (e.g., fe80::1%eth0). The regex used in pusb_tmux_has_remote_clients() expects whitespace immediately after the IP address and fails to account for the suffix. Consequently, the function erroneously concludes no remote clients are active, bypassing intended access restrictions. This is patched in version 0.9.3.

Impact

Successful exploitation allows for unauthorized authentication on systems configured to use pam_usb with the 'deny_remote' feature enabled, specifically when the environment utilizes multi-homed network interfaces and IPv6 link-local addresses.

Recommendation

• Upgrade the pam_usb authentication module to version 0.9.3 or later on all affected Linux systems.
• Audit PAM configurations to determine if deny_remote is active for pam_usb.
• Inventory Linux systems utilizing pam_usb for hardware-based authentication.

]]>highadvisory