mcdope pam_usb up to 0.8.x on Linux Environment Variable src/tmux.c uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, was found in mcdope pam_usb up to 0.8.x on Linux. This affects an unknown part of the file src/tmux.c of the component Environment Variable Handler. The manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2026-47274. The attack requires a local approach. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.8.x on Linux. It has been classified as problematic. Affected is some unknown functionality of the file src/tmux.c of the component Environment Variable Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-47274 since 05/19/2026. The exploitability is told to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

Upgrading to version 0.9.0 eliminates this vulnerability. Applying the patch 1ee8745920388df48d001a8e61ba629071557937 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32651). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8

License

• open-source

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion