# CVE-2026-47273: mcdope pam_usb XPath injection in configuration queries

Source: https://junglewise.ai/threats/cve-2026-47273-mcdope-pam-usb-xpath-injection-in-configuration-queries  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-47273 · Severity: medium · CVSS 6.5 · Published 2026-05-27

pam_usb is a tool that allows users to log into Linux systems using a USB drive as a physical key. A security flaw in how the tool processes usernames and device information could allow an attacker to bypass authentication checks. By using a specially crafted username or a modified USB device, an unauthorized person might gain access to the system by tricking the software into matching the wrong security profile.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-47273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47273 being exploited in the wild.

**How severe is CVE-2026-47273?** Medium severity, with a CVSS score of 6.5, published 27 May 2026.

**Which products and versions are affected?** Mcdope Pam Usb < 0.9.0.

**Is there a fix for CVE-2026-47273?** A patch was published on 2026-05-14: Fix merged into master branch via PR #311 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47273 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47273?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

pam_usb prior to version 0.9.0 is vulnerable to XPath injection (CWE-91) within its configuration parser (src/conf.c). The software constructs XPath queries to /etc/pamusb.conf using unvalidated identifiers including the PAM username, service name, and USB device metadata (serial, model, vendor). An attacker can inject arbitrary XPath predicates by providing strings containing single-quotes or control characters. This can be achieved remotely via network services that use PAM (e.g., SSH) or locally by presenting a USB device with malicious hardware identifiers. Successful exploitation could allow an attacker to manipulate the authentication logic to match incorrect device entries or bypass device-specific security constraints. The vulnerability is fixed in version 0.9.0 by implementing a validator that rejects unsafe characters.

## Affected products

- mcdope pam_usb < 0.9.0

## Timeline

- 2026-05-14: patched: Fix merged into master branch via PR #311
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE-2026-47273 published to NVD

## References

- [https://github.com/mcdope/pam_usb/commit/721fed08a3596cb5b4671ad702f8fdc12dcc7420](https://github.com/mcdope/pam_usb/commit/721fed08a3596cb5b4671ad702f8fdc12dcc7420)
- [https://github.com/mcdope/pam_usb/pull/311](https://github.com/mcdope/pam_usb/pull/311)
- [https://github.com/mcdope/pam_usb/security/advisories/GHSA-vfj3-5h5v-6g93](https://github.com/mcdope/pam_usb/security/advisories/GHSA-vfj3-5h5v-6g93)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [pam_usb XRDP session bypass via environment variable](https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)