CVE-2026-44711

{
  "id": "CVE-2026-44711",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T21:16:18.073",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7."
    },
    {
      "lang": "es",
      "value": "pam_usb proporciona autenticación por hardware para Linux utilizando medios extraíbles ordinarios. Antes de la versión 0.8.7, los ataques de enlaces simbólicos en el directorio pad y los archivos pad permiten la omisión de autenticación y la corrupción de archivos raíz. Esta vulnerabilidad está corregida en la versión 0.8.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mcdope",
          "product": "pam_usb",
          "versions": [
            {
              "version": "< 0.8.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "baseScore": 7.9,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T12:46:08.589726Z",
          "id": "CVE-2026-44711",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}