pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pa…

CVE-2026-48064 affects pam_usb, a hardware authentication system for Linux using removable media. Prior to version 0.9.1, when deny_remote=false is configured (common for display managers like gdm-password or lightdm), the PAM_RHOST check is bypassed. This allows remote XDMCP connections to reach USB device authentication instead of being properly rejected. The vulnerability enables remote attackers to bypass intended authentication restrictions when the system is misconfigured with deny_remote=false. The issue is fixed in version 0.9.1.