pam_usb is a hardware‑authenticator that uses removable media for one‑time pad files. In versions prior to 0.9.2 the code performs a separate existence check and creation of per‑device and per‑user pad directories, creating a TOCTOU race. A local attacker can exploit this by replacing the target path with a symlink to a directory they control. If the race is won, pad files are written to the attacker’s directory, potentially exposing sensitive pad values before they are used and allowing the attacker to disrupt or bypass authentication. This weakness is classified as CWE‑367 and primarily impacts confidentiality and integrity of the authentication system.

The vulnerability affects the PamUsb package from the vendor mcdope. All installations of pam_usb versions earlier than 0.9.2 are susceptible. The fix is included in 0.9.2, so systems running that or newer release versions are not affected.

The CVSS score of 5.8 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access with the ability to manipulate files in the pad directory path; it is not a remote exploit. Once the race is successfully won, the attacker can gain read access to pad files and possibly interfere with the authentication process, but does not necessarily achieve full system compromise unless additional privileges are obtained.