Linux‑PAM versions through 1.7.2 contain a timing side‑channel in the pam_userdb module’s plaintext password comparison routine. An attacker who can repeatedly trigger authentication via a calling service can measure the time it takes for the comparison to complete and use statistical analysis to reconstruct the full cleartext password. The flaw is identified as CWE‑208 and provides a direct path to password disclosure without requiring privilege escalation.

Any Linux system running Linux‑PAM 1.7.2 or earlier and that incorporates the pam_userdb module in its PAM stack is affected. Services that rely on pam_userdb for user authentication, such as sshd, sudo, or other PAM‑enabled programs, will expose the plaintext credential to an attacker with access to the authentication interface.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is less than 1%, showing very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker who can repeatedly initiate authentication—for example, a local user or someone with network‑adjacent access—can exploit the timing discrepancy to reconstruct the target user’s password. No privileged escalation is required, but the resulting password disclosure can lead to further compromise of the account or systems.