{"id":"CVE-2026-64666","summary":"pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset","details":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.","aliases":["GHSA-ffx6-xjp6-x33g"],"modified":"2026-11-12T07:04:18.532291910Z","published":"2026-11-11T03:51:12.232Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-807"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64666.json"},"references":[{"type":"WEB","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64666.json"},{"type":"ADVISORY","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64666"},{"type":"REPORT","url":"https://github.com/mcdope/pam_usb/issues/410"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"type":"FIX","url":"https://github.com/mcdope/pam_usb/pull/417"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mcdope/pam_usb","events":[{"introduced":"0"},{"fixed":"9993723a2836c7de547ea380af521ed5f5b51651"},{"fixed":"0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"0.9.3"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"}]},{"original_tag":"0.9.3","range":[{"fixed":"9993723a2836c7de547ea380af521ed5f5b51651"}],"source":"REFERENCES_TAG"}]}}],"versions":["0.9.2","0.9.1","0.9.0","0.8.7","0.8.4","0.8.3","v0.8.0","0.7.3","0.7.2","0.7.1","v0.7.0","0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64666.json","vanir_signatures":[{"source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"file":"src/local.c"},"deprecated":false,"digest":{"line_hashes":["42270652612144728068523263023684395714","92467262262306267519026642740662417934","136782600835749259801837679986067777916","273731649055318298262137346772523162547"],"threshold":0.9},"id":"CVE-2026-64666-01990f6d","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"file":"tests/unit/c/rmsvc_test.c","function":"main"},"deprecated":false,"digest":{"length":1480,"function_hash":"133439812045745079013501280075371764743"},"id":"CVE-2026-64666-055fb089","signature_type":"Function"},{"source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"file":"src/rmsvc.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231405346607090920517833426756054086003","6045695730409339658194645990711030597","258082933734874322488679539105203474029","34572357629708387945903035503027242653"]},"id":"CVE-2026-64666-b3158470","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["36794390175406245867292998272605640075","14118454235760970111291989330535841498","211018580476455854709578939467476225161","39299462975724824209930210508555015494","122664819363403932015733268923585587484","44657392357987321750895668504181055926","74769738928314161455279710513359181321","54243322391067484490214702115549818460","254630237333706933239479628105520326228","48514781077716934488093229789992329726"],"threshold":0.9},"id":"CVE-2026-64666-dbc1b0e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"file":"tests/unit/c/rmsvc_test.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"1152070341827645579688263229015029717","length":1737},"id":"CVE-2026-64666-e778a259","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"function":"pusb_has_active_remote_service","file":"src/rmsvc.c"}},{"digest":{"function_hash":"179079310922853850209356044249202837185","length":4589},"id":"CVE-2026-64666-eb74e21e","signature_type":"Function","signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f","target":{"file":"src/local.c","function":"pusb_local_login"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/mcdope/pam_usb/commit/9993723a2836c7de547ea380af521ed5f5b51651","target":{"file":"src/version.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["196826471672966929406198729402906788408"]},"id":"CVE-2026-64666-fc51f96e","signature_type":"Line"}],"vanir_signatures_modified":"2026-11-12T07:04:18Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}