Pam_usb (< 0.9.3)

The pam_usb authentication module version 0.8.0 through 0.9.2 fails to correctly parse link-local IPv6 addresses with zone indices, leading to an authentication bypass in the deny_remote feature.

The pam_usb module (prior to 0.9.3) incorrectly uses getenv() instead of secure_getenv() when checking the XRDP_SESSION variable in setuid contexts, enabling attackers to bypass XRDP-related authentication denials.