pam_usb, a Linux PAM module that allows hardware authentication via removable media, contained a flaw in version 0.8.6 and earlier. The module pamusb-pinentry reads the environment variable PINENTRY_FALLBACK_APP and executes its value directly, without validation or sanitisation. Because the variable is processed by the binary running with pam_usb privileges, any process that can inject an environment variable before pamusb-pinentry starts can execute arbitrary code with those privileges. The weakness is a classic CWE‑78 External Input Controlling System or Command Execution.

The affected product is mcdope's pam_usb, specifically any installation using a version earlier than 0.8.7. The fix was introduced in release 0.8.7, which validates or removes the PINENTRY_FALLBACK_APP variable before use.

The CVSS score for this vulnerability is 7.8, indicating a high impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can run a process that sets environment variables prior to the pamusb-pinentry invocation can trigger the flaw locally, leveraging pam_usb's privileges for arbitrary command execution. While the attack requires local authority to influence the environment, the consequences could be significant if the PAM module is employed in critical authentication workflows.