The flaw exists in pam_usb before version 0.9.2 when the temporary file used to update the one‑time pad is created without the O_EXCL flag. This allows two concurrent processes to both open the file and write to it, with the second write silently overwriting the first. Because the one‑time pad is the system’s replay‑prevention mechanism, the corrupted or partially updated pad could cause authentication failures or, if an attacker times the race precisely, create a brief interval where the pad can be reused, enabling a replay attack.

The issue affects the pam_usb library from the vendor mcdope. All instances running a version earlier than 0.9.2 are vulnerable. The 0.9.2 release incorporates the O_EXCL fix to eliminate the race condition.

The CVSS score is 5.8, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, since the race requires two concurrent update operations on the same pad. While a precise timing attack could allow a window for replaying credentials, the conditions are stringent, resulting in a moderate exploitation probability.