mcdope pam_usb up to 0.9.1 on Linux XML pam_usb.conf xmlReadFile xml external entity reference

Summaryinfo

A vulnerability classified as problematic was found in mcdope pam_usb up to 0.9.1 on Linux. Affected by this issue is the function xmlReadFile of the file pam_usb.conf of the component XML Handler. Executing a manipulation can lead to xml external entity reference. The identification of this vulnerability is CVE-2026-48981. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.9.1 on Linux. It has been declared as problematic. This vulnerability affects the function xmlReadFile of the file pam_usb.conf of the component XML Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-48981 since 05/27/2026. The exploitation appears to be difficult. Local access is required to approach this attack. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.9.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion