CVE-2026-47273: pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47273?
CVE-2026-47273 has a medium severity score of 6.5.
How do I fix CVE-2026-47273?
To fix CVE-2026-47273, upgrade to pam_usb version 0.9.0 or later.
What type of vulnerability is CVE-2026-47273?
CVE-2026-47273 is an XPath injection vulnerability that affects pam_usb.
What are the potential impacts of CVE-2026-47273?
The potential impacts of CVE-2026-47273 include unauthorized access due to manipulation of XPath queries.
Who is affected by CVE-2026-47273?
Users of pam_usb versions prior to 0.9.0 that rely on hardware authentication with removable media are affected by CVE-2026-47273.