XPath Injection Vulnerability in pam_usb Hardware Authentication

CVE-2026-47273

What is CVE-2026-47273?

The pam_usb module, which facilitates hardware authentication for Linux through ordinary removable media, is susceptible to an XPath injection vulnerability prior to version 0.9.0. The issue arises because it constructs XPath expressions using user-supplied identifiers (such as PAM usernames and service names) alongside device identifiers (like USB device serial numbers, models, and vendors) without validating these inputs for special XPath metacharacters. This flaw could allow malicious users to input arbitrary XPath predicates, potentially compromising the system's security by manipulating authentication checks. The vulnerability has been addressed and resolved in version 0.9.0 of pam_usb.

References