pam_usb silently ignores EACCES errors while opening /dev/input/event* nodes. When these errors occur, pusb_has_virtual_input_device() incorrectly reports no virtual devices, causing the PAM module to treat the lack of devices as a clean state and continue authentication. Based on the description, it is inferred that the failure to detect the required handheld devices permits a non‑privileged user to bypass the hardware‑based authentication requirement. This flaw is consistent with CWE‑390 (Error Condition Not Handled) and CWE‑693 (Security Misconfiguration).

The vulnerability affects the pam_usb software produced by the mcdope vendor. All versions released prior to 0.9.1 are affected; the security fix is included starting in version 0.9.1 and later. Packages containing older releases that are used in PAM configurations on Linux systems are at risk.

The CVSS base score of 4.4 indicates medium severity, and EPSS information is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user who can trigger a PAM authentication transaction that employs pam_usb. Because the error handling flaw occurs only when pam_usb runs without root privileges, a malicious user can initiate authentication through services such as remote desktop or other session initiation tools, potentially establishing an unauthorized session if the device authentication is skipped. The lack of an explicit denial when permissions are denied means the flaw remains active whenever pam_usb is invoked for non‑root sessions.