# CVE-2026-64666: pam_usb XRDP session bypass via environment variable

Source: https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-64666 · Severity: high · CVSS 7.1 · Published 2026-11-11

pam_usb is a Linux authentication module that enforces hardware-based access controls, including blocking remote desktop sessions. A flaw in version 0.9.2 and earlier allows an unprivileged user to bypass the XRDP remote desktop denial rule by unsetting an environment variable before authentication. This could enable unauthorized access to accounts when the hardware key requirement is the primary security control.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-64666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64666 being exploited in the wild.

**How severe is CVE-2026-64666?** High severity, with a CVSS score of 7.1, published 11 November 2026.

**Which products and versions are affected?** Mcdope Pam Usb 0.9.2 and earlier.

**Is there a fix for CVE-2026-64666?** Yes: fixed in 0.9.3. Until then: Ensure all process-based remote session detection signals remain operational (service scanning for xrdp, process ancestry checks, loginctl and utmp monitoring), as these provide defense-in-depth protection independent of the environment variable check. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64666 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-64666?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.3

Ensure all process-based remote session detection signals remain operational (service scanning for xrdp, process ancestry checks, loginctl and utmp monitoring), as these provide defense-in-depth protection independent of the environment variable check.

## Technical details

The vulnerability is an insecure environment variable read in src/local.c:366. The code uses getenv("XRDP_SESSION") instead of the privilege-dropping secure_getenv() function in a PAM context, allowing an attacker with local user privileges to unset the variable before invoking a setuid PAM host (login, su, sudo, polkit). While other remote-detection mechanisms (process scanning, service checks) remain in place, this specific env-based check alone can be defeated.

## Affected products

- mcdope pam_usb 0.9.2 and earlier

## Timeline

- 2026-05-24: disclosed
- 2026-05-25: patched
- 2026-11-11: advisory

## References

- [https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f](https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f)
- [https://github.com/mcdope/pam_usb/issues/410](https://github.com/mcdope/pam_usb/issues/410)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)
- [mcdope pam_usb environment variable injection in local-check logic](https://junglewise.ai/threats/cve-2026-48980-mcdope-pam-usb-environment-variable-injection-in-local-check)