# CVE-2026-44711: mcdope pam_usb authentication bypass and file corruption via symlink attack

Source: https://junglewise.ai/threats/cve-2026-44711-mcdope-pam-usb-authentication-bypass-and-file-corruption-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-44711 · Severity: high · CVSS 7.9 · Published 2026-05-27

pam_usb is a Linux authentication module that allows users to log in using a physical USB drive instead of a password. A security flaw allows a local attacker to bypass this hardware check by using symbolic links to point the system at fake authentication data. Additionally, the flaw can be used to corrupt critical system files, potentially leading to a complete system failure or permanent data loss.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-44711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44711 being exploited in the wild.

**How severe is CVE-2026-44711?** High severity, with a CVSS score of 7.9, published 27 May 2026.

**Which products and versions are affected?** Mcdope Pam Usb < 0.8.7.

**Is there a fix for CVE-2026-44711?** A patch was published on 2026-05-27: Fix released in version 0.8.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44711 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44711?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple vulnerabilities exist in src/pad.c of pam_usb due to insecure file handling. First, the module uses stat() on the pad directory, allowing a user to replace it with a symlink to an attacker-controlled directory to bypass hardware authentication. Second, the module uses fopen() on temporary pad files without O_NOFOLLOW, allowing a local user to create a symlink that causes the PAM module (running as root) to truncate and corrupt arbitrary system files during authentication. Finally, a partial read vulnerability in the pad comparison function can lead to uninitialized memory being used in authentication checks. These issues are resolved in version 0.8.7 by switching to lstat(), implementing O_NOFOLLOW flags, and enforcing strict read size checks.

## Affected products

- mcdope pam_usb < 0.8.7

## Timeline

- 2026-05-07: advisory: GitHub security advisory published by maintainer
- 2026-05-27: disclosed: CVE published to NVD
- 2026-05-27: patched: Fix released in version 0.8.7

## References

- [https://github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34](https://github.com/mcdope/pam_usb/security/advisories/GHSA-fjpm-p9pj-mp34)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [pam_usb XRDP session bypass via environment variable](https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)