CVE-2026-47272

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.0

Description The pusb pad compare() function in src/pad.c only verifies that the user-side pad (~/.pamusb/device.pad) is readable, without ensuring the system-side pad on the USB device is present and readable. If the user-side pad is deleted or unreadable, the function returns a failure that some code paths treat as non-fatal, allowing authentication to succeed without verifying the USB device. Consequently, a local user can delete their own ~/.pamusb/device.pad to bypass the physical USB device requirement.

Recommendations Update to version 0.9.0.