CVE-2026-44711 — pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

CVE-2026-44711

pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption PUBLISHED

Description (CNA)

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

Affected (CNA)

Vendor / product	Versions
mcdope / pam_usb	affected < 0.8.7

CWE

CWE-59, CWE-287

References

https://github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5