The pam_usb collection of helper tools used for hardware authentication on Linux suffers from an uncontrolled search path vulnerability. Prior to version 0.9.0, the tools resolved external binaries using the PATH environment variable instead of hard‑coded absolute paths. An attacker who can influence the process environment during PAM authentication or while invoking these tools can point PATH to a malicious binary, causing the tools to execute that binary. This substitute binary runs with the privileges of the PAM service process, enabling an attacker to gain elevated privileges on the affected system.

The vulnerability affects the pam_usb package distributed by the mcdope project, specifically versions earlier than 0.9.0, which include the utilities pamusb-check, pamusb-conf, and pamusb-keyring-unlock-gnome.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local and requires the attacker to manipulate the PATH environment for a PAM authentication or tool execution. Once the attacker succeeds, they may execute arbitrary code with elevated privileges, but the exploitation requires local access and the ability to influence the environment used by pam_usb.