pam_usb constructs XPath queries from user supplied identifiers such as the PAM username, service name, and USB device properties. These values were not sanitized for XPath metacharacters, enabling an attacker to inject arbitrary XPath predicates into the query that evaluates the local configuration file /etc/pamusb.conf. The injected predicates could manipulate the query logic and allow the attacker to retrieve sensitive configuration data or otherwise influence authentication behavior. The vulnerability demonstrates a classic XPath injection weakness (CWE‑91).

The affected product is pam_usb from the mcdope project. Versions before 0.9.0 are vulnerable; version 0.9.0 and later contain the fix.

The CVSS score of 6.5 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who can influence the PAM username, service name, or USB device identifiers can exploit the injection during an authentication attempt. While no public exploit is reported, the moderate CVSS indicates that if an attacker can provide crafted input, they could potentially read configuration details that may aid further attacks. The fix is available in version 0.9.0; updating to that release mitigates the issue.