CVE-2026-64666 pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

pamusb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDPSESSION with plain getenv3 at the head of pusblocallogin while every other env consumer in the same function uses securegetenv3. When pamusb.so loads into a setuid PAM host, the...

CVE-2026-64666

The pam_usb hardware authentication module for Linux (prior to version 0.9.3 ) is vulnerable to an environment variable bypass. The component src/local.c incorrectly uses the plain getenv(3) function to read XRDP_SESSION within pusb_local_login, while other environment consumers in the same funct...