CVE-2026-47272: pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer

Synopsis

An authentication bypass vulnerability exists in pam_usb, a PAM module that provides hardware-backed login using removable USB media. A local attacker with a low-privilege account can delete their own ~/.pamusb/device.pad file, causing the pad comparison function to return a non-fatal failure that the authentication code path incorrectly treats as a pass, eliminating the USB device requirement entirely. Successful exploitation lets an attacker authenticate to any service backed by pam_usb without possessing the physical USB device, enabling full account takeover for that user. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the bypass.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker only needs enough access to delete their own ~/.pamusb/device.pad file.

• Victim interactionNot required

  No interaction from another user or administrator is needed; the attacker acts entirely on their own account.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: deleting a single file in the attacker's home directory is enough to trigger the bypass reliably.

Blast Radius

• The attacker authenticates to pam_usb-protected services, such as sudo, su, screen-lock, or SSH, without possessing the required physical USB device.
• Confidential data accessible to the compromised account, including files, environment variables, and credentials stored in the home directory, is exposed to the attacker.
• The attacker can modify, overwrite, or delete files and configurations owned by the account, potentially escalating further if the account has sudo rights.