Pam_usb (>= 0.8.0, < 0.9.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pam_usb--0.8.0--0.9.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpam_usb: Authentication policy bypass via IPv6 (CVE-2026-64669)https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/Wed, 11 Nov 2026 13:58:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64669/The pam_usb module incorrectly evaluates remote tmux sessions due to a faulty IPv6 regex, allowing authentication when the deny_remote feature should be triggered.The pam_usb hardware authentication module contains a security flaw in the deny_remote feature, tracked as CVE-2026-64669. The vulnerability exists within pusb_tmux_has_remote_clients() in src/tmux.c, where an overly restrictive IPv6 regex fails to identify compressed IPv6 addresses. When a user connects to a remote tmux session using a compressed address (e.g., ::1 or 2001:db8::1), the module fails to detect the remote presence and treats the session as local, effectively bypassing the deny_remote policy. This vulnerability affects pam_usb versions 0.8.0 through 0.9.2.

Impact

Successful exploitation allows a user to bypass intended security policy restrictions that are designed to block authentication when a remote tmux session is active, potentially granting unauthorized access to the system via the hardware token if the remote session is active.

Recommendation

  • Upgrade the pam_usb module to version 0.9.3 or later on all affected Linux systems.
  • Audit PAM configuration files to determine if the deny_remote option is enabled, as the vulnerability only impacts systems utilizing this specific configuration.
  • Prioritize patching for systems where hardware-based authentication is the primary barrier for remote-accessible accounts.
]]>highadvisory