CVE-2026-47274: Mcdope Pam USB

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

Affected products

• Mcdope Pam USB: before 0.9.0 (fixed in 0.9.0)

Published 2026-05-27. Last modified 2026-06-17.