CVE-2026-47272: pam_usb Authentication Bypass Vulnerability

CVE-2026-47272 Overview

CVE-2026-47272 is an authentication bypass vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using removable USB media. The flaw resides in the pusb_pad_compare() function inside src/pad.c. The function verifies only that the user-side pad at ~/.pamusb/device.pad can be read, while failing to enforce that the system-side pad on the USB device is also present and readable. A local authenticated user can delete their own user-side pad to bypass the USB hardware requirement and authenticate without the physical device. The issue is fixed in pam_usb 0.9.0.

Critical Impact
A local user can remove their ~/.pamusb/device.pad file to bypass the USB hardware authentication factor entirely, defeating the security guarantee of two-factor login.

Affected Products

pam_usb versions prior to 0.9.0
Linux systems configured to use pam_usb as an authentication factor
Any service relying on pam_usb for hardware-backed login enforcement

Discovery Timeline

2026-05-27 - CVE CVE-2026-47272 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-47272

Vulnerability Analysis

The vulnerability is an authentication bypass [CWE-287] caused by incomplete validation of authentication artifacts. pam_usb implements a two-pad challenge model: a user-side pad stored at ~/.pamusb/device.pad and a system-side pad stored on the USB device itself. Successful authentication requires both pads to be present and to match. The pusb_pad_compare() function in src/pad.c reads the user-side pad first. When that file is missing or unreadable, the function returns a failure code that downstream code paths interpret as non-fatal rather than as an authentication denial. The system-side pad on the USB device is therefore never required to be read or compared, and the hardware factor is silently dropped from the decision.

Root Cause

The root cause is improper error-handling logic. A failure to read the user-side pad should be treated as a hard authentication failure, since both pads are required to prove possession of the registered USB device. Instead, the failure flowed into a path that allowed authentication to proceed. This collapses a two-factor check into a single-factor check controlled entirely by the local user.

Attack Vector

Exploitation requires local access and the ability to authenticate as the target user account on the system. The attacker deletes or renames ~/.pamusb/device.pad, then triggers any PAM-mediated action configured with pam_usb, such as login, sudo, or screen unlock. The bypass succeeds without the registered USB device being inserted. Because the attacker controls files inside their own home directory, no elevated privileges are needed to stage the bypass. The vulnerability is not network-reachable and requires no user interaction beyond the attacker's own session.

No public proof-of-concept code is available. See the GitHub Security Advisory for upstream technical details.

Detection Methods for CVE-2026-47272

Indicators of Compromise

Deletion, truncation, or permission changes affecting ~/.pamusb/device.pad for any user configured with pam_usb.
Successful PAM authentication events for pam_usb-protected services with no corresponding USB insertion event in kernel or udev logs.
Repeated authentication failures from pam_usb immediately followed by a success without device presence.

Detection Strategies

Monitor file integrity for the ~/.pamusb/ directory across all users and alert on removal of device.pad.
Correlate PAM session-open events with udev USB attach events to flag authentications that lack a matching device-present signal.
Audit installed pam_usb versions across the fleet and flag any host running a release earlier than 0.9.0.

Monitoring Recommendations

Forward /var/log/auth.log, journald PAM events, and udev USB events to a central log platform for correlation.
Enable Linux audit rules (auditd) targeting ~/.pamusb/device.pad with -w /home/*/.pamusb/device.pad -p wa.
Track use of sudo, su, and graphical unlock against the expected USB-present baseline for each user.

How to Mitigate CVE-2026-47272

Immediate Actions Required

Upgrade pam_usb to version 0.9.0 or later on all affected Linux hosts.
Inventory PAM configurations under /etc/pam.d/ to identify every service that loads pam_usb.so and confirm coverage of the upgrade.
Restore any deleted ~/.pamusb/device.pad files and re-enroll affected users where integrity cannot be confirmed.

Patch Information

The upstream fix is shipped in pam_usb 0.9.0. The patch enforces that both the user-side and system-side pads are present and readable before authentication can succeed, ensuring that a missing user-side pad results in a hard denial. Refer to the GitHub Security Advisory GHSA-vx6f-rrqr-j87c for release details.

Workarounds

Until upgrade is possible, remove pam_usb.so from PAM stacks where hardware enforcement is security-critical and rely on alternative factors.
Configure PAM stacks so that pam_usb is required rather than sufficient, and pair it with a second independent factor that cannot be removed by the user.
Apply restrictive permissions and audit watches on each user's ~/.pamusb/ directory to detect tampering with the pad file.

bash

# Example: enforce auditd watch on pam_usb pad files
auditctl -w /home -p wa -k pamusb_pad
find /home -maxdepth 3 -type f -name device.pad -exec ls -l {} \;