pam_usb provides hardware authentication by checking the utmpx ut_addr_v6 field to decide whether an authentication request comes from a remote session. The deny_remote feature only examined the first 32‑bit word of the 128‑bit address, so IPv4‑mapped IPv6 addresses (stored in the last word) were incorrectly classified as local. This allowed an attacker who physically possessed a registered USB token to authenticate over SSH as if they were a local user, thereby bypassing the deny_remote restriction and gaining access through a remote channel.

The vulnerability affects the mcdope:pam_usb package on Linux systems that use the pam_usb plug‑in for USB token authentication. Versions prior to 0.9.0 are impacted; the fix is present in 0.9.0 and later.

The CVSS score of 7.4 indicates a high severity with potential for remote authentication bypass. EPSS data is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker with physical access to a registered USB token connecting to an SSH service that accepts IPv6 wildcard connections with AddressFamily any, allowing the exploit to be triggered remotely.