{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pam_usb--0.8.0--0.9.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pam_usb_project:pam_usb:*:*:*:*:*:linux:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-64669"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pam_usb (\u003e= 0.8.0, \u003c 0.9.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["pam_usb"],"content_html":"\u003cp\u003eThe pam_usb hardware authentication module contains a security flaw in the \u003ccode\u003edeny_remote\u003c/code\u003e feature, tracked as CVE-2026-64669. The vulnerability exists within \u003ccode\u003epusb_tmux_has_remote_clients()\u003c/code\u003e in \u003ccode\u003esrc/tmux.c\u003c/code\u003e, where an overly restrictive IPv6 regex fails to identify compressed IPv6 addresses. When a user connects to a remote tmux session using a compressed address (e.g., \u003ccode\u003e::1\u003c/code\u003e or \u003ccode\u003e2001:db8::1\u003c/code\u003e), the module fails to detect the remote presence and treats the session as local, effectively bypassing the \u003ccode\u003edeny_remote\u003c/code\u003e policy. This vulnerability affects pam_usb versions 0.8.0 through 0.9.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a user to bypass intended security policy restrictions that are designed to block authentication when a remote tmux session is active, potentially granting unauthorized access to the system via the hardware token if the remote session is active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the pam_usb module to version 0.9.3 or later on all affected Linux systems.\u003c/li\u003e\n\u003cli\u003eAudit PAM configuration files to determine if the \u003ccode\u003edeny_remote\u003c/code\u003e option is enabled, as the vulnerability only impacts systems utilizing this specific configuration.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for systems where hardware-based authentication is the primary barrier for remote-accessible accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:58:14Z","date_published":"2026-11-11T13:58:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/","summary":"The pam_usb module incorrectly evaluates remote tmux sessions due to a faulty IPv6 regex, allowing authentication when the deny_remote feature should be triggered.","title":"pam_usb: Authentication policy bypass via IPv6 (CVE-2026-64669)","url":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/"}],"language":"en","title":"CraftedSignal Threat Feed - Pam_usb (\u003e= 0.8.0, \u003c 0.9.3)","version":"https://jsonfeed.org/version/1.1"}