What’s Vulnerable › Vulnerabilities

CVE-2026-54411: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-14 · updated 2026-08-10
• Weakness: CWE-208

Description

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Affected products

• Linux-PAM: through 1.7.2

References

• https://cwe.mitre.org/data/definitions/208.html
• https://github.com/linux-pam/linux-pam
• https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h
• https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327

Get alerted when CVE-2026-54411 or the next vulnerability affects your stack