CVE-2026-48980

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.2

Description This software provides hardware authentication for Linux using removable media. A flaw exists where the getenv() function allows environment variable injection into local-check logic via the XRDP SESSION, DISPLAY, and TMUX variables. These variables determine if a session is local or remote. When a PAM module runs within the context of setuid binaries such as sudo or su, getenv() can return values controlled by a local user who has manipulated the process environment.

Recommendations Update to version 0.9.2.