pam_usb is a PAM module that authenticates users using removable USB media. The vulnerability resides in a missing check of the remote host field (PAM_RHOST). When the configuration option deny_remote is set to false—a common practice for display managers like gdm-password or lightdm—the PAM_RHOST value supplied by remote daemons such as SSH or XDMCP is ignored. This omission, categorized as CWE‑863, permits a remote XDMCP session to reach the USB authentication step without the module rejecting the connection, thereby enabling an attacker to bypass the usual remote host verification and potentially gain authenticated access to the system.

The affected product is pam_usb released by mcdope. All versions prior to 0.9.1 are vulnerable. Systems that use pam_usb with deny_remote set to false (for example, Linux installations running gdm-password or lightdm) are impacted.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, so exploitation frequency cannot be quantified, but the flaw exists in every pre‑0.9.1 release and remote XDMCP is a widely deployed protocol, providing a clear attack vector. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no publicly known exploits yet, but the straightforward bypass path could be leveraged by an attacker with access to a remote XDMCP session.