pam_usb uses removable media to authenticate Linux users. Prior to version 0.8.7, attackers can create symbolic links in the pad directory or target pad files, causing the authentication process to follow the link and write to privileged paths. The result is that the attacker can authenticate without valid credentials and corrupt root‑level files, potentially compromising system integrity. The weakness is reflected in CWE‑287 (Authentication Bypass) and CWE‑59 (Improper Handling of Absolute Path).

The vulnerability affects the pam_usb module from mcdope. All releases prior to 0.8.7 are impacted; upgrading to 0.8.7 or later removes the flaw.

The CVSS score of 7.9 indicates a High impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a local attacker who can place or manipulate removable media that the system will read during authentication. By crafting a symlink that points to a high‑privilege file, the attacker can both bypass authentication and overwrite critical system files. This combination of bypass and destructive behavior results in a severe threat if exploited.