mcdope pam_usb up to 0.9.2 deny_remote src/tmux.c pusb_tmux_has_remote_clients incorrect regex

Summaryinfo

A vulnerability was found in mcdope pam_usb up to 0.9.2. It has been rated as critical. This vulnerability affects the function pusb_tmux_has_remote_clients of the file src/tmux.c of the component deny_remote. Performing a manipulation results in incorrect regex. This vulnerability was named CVE-2026-64669. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in mcdope pam_usb up to 0.9.2. This affects the function pusb_tmux_has_remote_clients of the file src/tmux.c of the component deny_remote. The manipulation with an unknown input leads to a incorrect regex vulnerability. CWE is classifying the issue as CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned "no remote clients" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-64669 since 07/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.9.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1
• 0.9.2

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion