CVE-2026-47273: pam_usb XXE Vulnerability

CVE-2026-47273 Overview

CVE-2026-47273 is an XPath injection vulnerability in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux using ordinary removable media. Versions prior to 0.9.0 construct XPath expressions from user-supplied and device-supplied identifiers without validation. These identifiers include the PAM username, service name, USB device serial, model, and vendor strings used to query /etc/pamusb.conf. An attacker can inject arbitrary XPath predicates to alter configuration lookups. The flaw is tracked as CWE-91: XML Injection and is fixed in version 0.9.0.

Critical Impact
Successful injection can manipulate authentication configuration lookups, allowing an attacker to influence which device or user record matches during PAM authentication.

Affected Products

pam_usb versions prior to 0.9.0
Linux systems using pam_usb for USB-based hardware authentication
Systems with /etc/pamusb.conf configured for multi-user or multi-device authentication

Discovery Timeline

2026-05-27 - CVE-2026-47273 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-47273

Vulnerability Analysis

The vulnerability stems from how pam_usb builds XPath queries against its XML configuration file /etc/pamusb.conf. Identifier strings flow directly into XPath expressions without escaping or validation. Both user-controlled inputs (PAM username, service name) and device-controlled inputs (USB serial, model, vendor) are concatenated into the query string. An attacker who can supply a crafted username at the PAM layer, or attach a USB device with crafted descriptor strings, can inject XPath metacharacters such as single quotes and predicate brackets. The injection alters the structure of the query rather than just its value, causing the configuration lookup to return attacker-chosen nodes. The impact targets integrity of the authentication decision because configuration matching governs which device is accepted for which user.

Root Cause

The root cause is missing input validation on XPath identifier values in src/conf.c. The configuration loader passed raw char* identifiers into XPath construction without checking for metacharacters such as ' (single quote) or control characters below 0x20. There was no allowlist or escaping routine applied to either user-supplied or device-supplied strings before they reached the XPath engine.

Attack Vector

Exploitation can occur through two paths. First, a local attacker can supply a crafted PAM username or service name containing XPath metacharacters at authentication time. Second, an attacker who controls a USB device can program crafted serial, model, or vendor descriptor strings that are read by pam_usb when the device is inserted. In either case, the injected XPath predicate can shift the query to match an unintended <user> or <device> node in /etc/pamusb.conf.

// Patch from src/conf.c - reject unsafe XPath identifiers
static int pusb_conf_xpath_id_is_safe(const char *name, const char *value)
{
    const unsigned char *cursor;

    if (value == NULL || value[0] == '\0')
    {
        log_error("%s is empty.\n", name);
        return 0;
    }

    for (cursor = (const unsigned char *)value; *cursor != '\0'; ++cursor)
    {
        if (*cursor == '\'' || *cursor < 0x20)
        {
            log_error("%s contains an unsafe character for XPath lookup.\n", name);
            return 0;
        }
    }

    return 1;
}

Source: GitHub Commit 721fed0. The fix rejects any identifier containing a single quote or control character before it reaches the XPath query.

Detection Methods for CVE-2026-47273

Indicators of Compromise

PAM authentication log entries containing single quotes, brackets, or non-printable characters in the username or service fields.
USB device insertion events where the device serial, model, or vendor strings contain XPath metacharacters such as ', [, ], or or 1=1-style predicates.
Successful pam_usb authentications that do not correspond to a known enrolled user-device pair in /etc/pamusb.conf.

Detection Strategies

Audit /var/log/auth.log and journalctl -u systemd-logind for malformed identifier strings reaching PAM.
Compare udev device attribute logs against the device records defined in /etc/pamusb.conf to find descriptor mismatches.
Inspect the running pam_usb version with dpkg -s libpam-usb or equivalent and flag any installation older than 0.9.0.

Monitoring Recommendations

Forward PAM and udev events to a centralized log platform and alert on non-ASCII or quote characters in authentication identifiers.
Monitor for repeated authentication attempts from the same USB serial across different user accounts, which may indicate enumeration of injected predicates.
Track changes to /etc/pamusb.conf using file integrity monitoring to detect tampering that pairs with injection attempts.

How to Mitigate CVE-2026-47273

Immediate Actions Required

Upgrade pam_usb to version 0.9.0 or later on all Linux hosts that use it for authentication.
Inventory systems referencing pam_usb.so in /etc/pam.d/ files to confirm all instances are patched.
Restrict physical access to systems where pam_usb is enrolled, since malicious USB descriptors are part of the attack surface.

Patch Information

The fix is committed in pam_usb commit 721fed0 and merged via Pull Request #311. Release 0.9.0 adds the pusb_conf_xpath_id_is_safe validator that rejects identifiers containing single quotes or control characters before they are interpolated into XPath queries. Full details are documented in GHSA-vfj3-5h5v-6g93.

Workarounds

If patching is not immediately possible, disable pam_usb by removing or commenting its auth lines from files under /etc/pam.d/ and rely on password or token authentication.
Limit which users have entries in /etc/pamusb.conf so that injection cannot pivot to high-privilege accounts that are not enrolled.
Enforce USB device allowlisting at the kernel level using udev rules to block devices whose descriptor strings contain non-printable or quote characters.

bash

# Verify installed pam_usb version and upgrade
dpkg -s libpam-usb | grep -i version

# Debian/Ubuntu - upgrade to fixed release
sudo apt update && sudo apt install --only-upgrade libpam-usb

# Temporary mitigation: disable pam_usb in a PAM stack
sudo sed -i 's|^\(auth.*pam_usb.so.*\)|# \1|' /etc/pam.d/common-auth