Every CVE Search/ Get API key

CVE-2026-54411

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

6.9 MediumFix available

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.32%Unchanged since Jun 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
CVE-2026-54411
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
EUVDEUVD-2026-36662 6.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
EUVD-2026-36662
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
GitHub AdvisoriesGHSA-56gg-22rq-q53x 6.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb...

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.

Record
GHSA-56gg-22rq-q53x
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
NVD 6.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
CVE-2026-54411
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
OSV 6.9

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
CVE-2026-54411
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Weakness
CWE-208
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54411 6.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
DEBIAN-CVE-2026-54411
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X
Updated
2026-11-02
Show 42 moreShow less
OSVOESA-2026-2900 6.9

pam security update

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)

Record
OESA-2026-2900
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
OSVOESA-2026-2901 6.9

pam security update

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)

Record
OESA-2026-2901
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
OSVOESA-2026-2902 6.9

pam security update

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)

Record
OESA-2026-2902
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
OSVOESA-2026-2903 6.9

pam security update

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)

Record
OESA-2026-2903
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
OSVOESA-2026-3008 6.9

pam security update

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.(CVE-2026-54411)

Record
OESA-2026-3008
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
Updated
2026-11-02
OSVRHSA-2026:35016 4.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:35016
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:56131 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:56131
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:59379 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:59379
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:60224 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:60224
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61223 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61223
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61224 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61224
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61225 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61225
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61226 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61226
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61227 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61227
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61228 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61228
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61229 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61229
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:61230 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:61230
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:64815 4.8

Red Hat Security Advisory: pam security update

Record
RHSA-2026:64815
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:7553 4.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7553
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:56131 4.8

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:56131
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:59379 4.8

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:59379
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:64815 4.8

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE age(s) listed in the References section.

Record
RLSA-2026:64815
CVSS 3.1
4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54411 6.9

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
UBUNTU-CVE-2026-54411
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:N/V:D
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:56131 No score

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:56131
Updated
2026-11-02
OSVALSA-2026:59379 No score

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:59379
Updated
2026-11-02
OSVALSA-2026:64815 No score

Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

  • linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE age(s)
listed in the References section.

Record
ALSA-2026:64815
Updated
2026-11-02
OSVAZL-90093 No score

CVE-2026-54411 affecting package pam for versions less than 1.5.3-5

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Record
AZL-90093
Updated
2026-11-05
OSVCLSA-2026-1788971665 No score

pam: Fix of CVE-2026-54411

  • CVE-2026-54411: pam_userdb: observable timing discrepancy in the plaintext password comparison path allowed recovery of the stored password's length and prefix bytes (CWE-208)
Record
CLSA-2026-1788971665
Updated
2026-11-02
OSVCLSA-2026-1789472351 No score

pam: Fix of CVE-2026-54411

  • CVE-2026-54411: pam_userdb: observable timing discrepancy in the plaintext password comparison path allowed recovery of the stored password's length and prefix bytes (CWE-208)
Record
CLSA-2026-1789472351
Updated
2026-11-02
OSVMGASA-2026-0461 No score

Updated pam packages fix a security vulnerability

The updated packages fix a security vulnerability: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison. (CVE-2026-54411)

Record
MGASA-2026-0461
Updated
2026-11-02
OSVopenSUSE-SU-2026:11201-1 No score

pam-1.7.2+git12-2.1 on GA media

These are all security issues fixed in the pam-1.7.2+git12-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11201-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21320-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
openSUSE-SU-2026:21320-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-54411 No score

CVE-2026-54411 in pam - Patched by Root

Root has patched CVE-2026-54411 in the pam package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-54411
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-54411 No score

CVE-2026-54411 in pam - Patched by Root

Root has patched CVE-2026-54411 in the pam package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-54411
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-54411 No score

CVE-2026-54411 in pam - Patched by Root

Root has patched CVE-2026-54411 in the pam package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-54411
Updated
2026-11-02
OSVSUSE-SU-2026:22599-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:22599-1
Updated
2026-11-02
OSVSUSE-SU-2026:22639-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:22639-1
Updated
2026-11-02
OSVSUSE-SU-2026:22807-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:22807-1
Updated
2026-11-02
OSVSUSE-SU-2026:22896-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:22896-1
Updated
2026-11-02
OSVSUSE-SU-2026:3162-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:3162-1
Updated
2026-11-02
OSVSUSE-SU-2026:3163-1 No score

Security update for pam

This update for pam fixes the following issue

  • CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
Record
SUSE-SU-2026:3163-1
Updated
2026-11-02
OSVUSN-8601-1 No score

pam vulnerability

It was discovered that PAM had a timing discrepancy in the pam_userdb module when comparing plaintext passwords. An attacker could possibly use this issue to obtain sensitive information by measuring response-timing differences during repeated authentication attempts.

Record
USN-8601-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pam
AlmaLinux:8
 before 1.3.1-40.el8_10
1.3.1-40.el8_10
pam-devel
AlmaLinux:8
 before 1.3.1-40.el8_10
1.3.1-40.el8_10
pam
AlmaLinux:10
 before 1.6.1-9.el10_2.1
1.6.1-9.el10_2.1
pam-devel
AlmaLinux:10
 before 1.6.1-9.el10_2.1
1.6.1-9.el10_2.1
pam-libs
AlmaLinux:10
 before 1.6.1-9.el10_2.1
1.6.1-9.el10_2.1
pam
AlmaLinux:9
 before 1.5.1-28.el9_8.1
1.5.1-28.el9_8.1
pam-devel
AlmaLinux:9
 before 1.5.1-28.el9_8.1
1.5.1-28.el9_8.1
pam-docs
AlmaLinux:9
 before 1.5.1-28.el9_8.1
1.5.1-28.el9_8.1
pam
Azure Linux:3
 before 1.5.3-5
1.5.3-5
pam
TuxCare:AlmaLinux:9.2
 before 1.5.1-14.el9.tuxcare.els6
1.5.1-14.el9.tuxcare.els6
Show 134 moreShow less
Affected packages
PackageAffectedFixed
pam-devel
TuxCare:AlmaLinux:9.2
 before 1.5.1-14.el9.tuxcare.els6
1.5.1-14.el9.tuxcare.els6
pam-docs
TuxCare:AlmaLinux:9.2
 before 1.5.1-14.el9.tuxcare.els6
1.5.1-14.el9.tuxcare.els6
pam
TuxCare:AlmaLinux:9.6
 before 1.5.1-26.el9_6.tuxcare.els1
1.5.1-26.el9_6.tuxcare.els1
pam-devel
TuxCare:AlmaLinux:9.6
 before 1.5.1-26.el9_6.tuxcare.els1
1.5.1-26.el9_6.tuxcare.els1
pam-docs
TuxCare:AlmaLinux:9.6
 before 1.5.1-26.el9_6.tuxcare.els1
1.5.1-26.el9_6.tuxcare.els1
pam
Debian:12
 All versions, plus listed versions
1.5.2-61.5.2-6+deb12u11.5.2-6+deb12u21.5.2-71.5.2-8
Show 19 moreShow less
1.5.2-91.5.2-9.11.5.3-11.5.3-21.5.3-31.5.3-41.5.3-51.5.3-61.5.3-6+hurd.11.5.3-71.7.0-11.7.0-21.7.0-2+hurd.11.7.0-31.7.0-41.7.0-51.7.0-61.7.0-71.7.0-8
 None known
pam
Debian:13
 All versions, plus listed versions
1.7.0-51.7.0-61.7.0-71.7.0-8
 None known
pam
Debian:14
 All versions, plus listed versions
1.7.0-51.7.0-61.7.0-71.7.0-8
 None known
pam
Mageia:10
 before 1.7.1-2.1.mga10
1.7.1-2.1.mga10
pam
openEuler:20.03-LTS-SP4
 before 1.4.0-20.oe2003sp4
1.4.0-20.oe2003sp4
pam
openEuler:22.03-LTS-SP4
 before 1.5.2-17.oe2203sp4
1.5.2-17.oe2203sp4
pam
openEuler:24.03-LTS-SP1
 before 1.5.3-12.oe2403sp1
1.5.3-12.oe2403sp1
pam
openEuler:24.03-LTS-SP3
 before 1.5.3-12.oe2403sp3
1.5.3-12.oe2403sp3
pam
openEuler:24.03-LTS-SP4
 before 1.5.3-12.oe2403sp4
1.5.3-12.oe2403sp4
pam
Red Hat:hummingbird:1
 before 0:1.7.2-2.2.hum1
0:1.7.2-2.2.hum1
pam-devel
Red Hat:hummingbird:1
 before 0:1.7.2-2.2.hum1
0:1.7.2-2.2.hum1
pam-doc
Red Hat:hummingbird:1
 before 0:1.7.2-2.2.hum1
0:1.7.2-2.2.hum1
pam-libs
Red Hat:hummingbird:1
 before 0:1.7.2-2.2.hum1
0:1.7.2-2.2.hum1
pam
Red Hat:enterprise_linux:8::baseos
 before 0:1.3.1-40.el8_10
0:1.3.1-40.el8_10
pam-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.3.1-40.el8_10
0:1.3.1-40.el8_10
pam-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.3.1-40.el8_10
0:1.3.1-40.el8_10
pam-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.3.1-40.el8_10
0:1.3.1-40.el8_10
pam-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam-devel
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam-libs-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam-libs
Red Hat:enterprise_linux:10.2
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam-devel
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam-docs
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-27.el9_8.1
0:1.5.1-27.el9_8.1
pam
Red Hat:rhel_aus:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-debuginfo
Red Hat:rhel_aus:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-debugsource
Red Hat:rhel_aus:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-devel
Red Hat:rhel_aus:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-debugsource
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam-devel
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:1.3.1-16.el8_6.4
0:1.3.1-16.el8_6.4
pam
Red Hat:rhel_aus:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-debuginfo
Red Hat:rhel_aus:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-debugsource
Red Hat:rhel_aus:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-devel
Red Hat:rhel_aus:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-debuginfo
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-debugsource
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam-devel
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:1.3.1-14.el8_4.3
0:1.3.1-14.el8_4.3
pam
Red Hat:rhel_e4s:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-debuginfo
Red Hat:rhel_e4s:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-debugsource
Red Hat:rhel_e4s:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-devel
Red Hat:rhel_e4s:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam
Red Hat:rhel_tus:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-debuginfo
Red Hat:rhel_tus:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-debugsource
Red Hat:rhel_tus:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-devel
Red Hat:rhel_tus:8.8::baseos
 before 0:1.3.1-26.el8_8.3
0:1.3.1-26.el8_8.3
pam-debuginfo
Red Hat:rhel_e4s:9.2::appstream
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam-debugsource
Red Hat:rhel_e4s:9.2::appstream
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam-devel
Red Hat:rhel_e4s:9.2::appstream
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam-docs
Red Hat:rhel_e4s:9.2::appstream
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam
Red Hat:rhel_e4s:9.2::baseos
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam-debuginfo
Red Hat:rhel_e4s:9.2::baseos
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam-debugsource
Red Hat:rhel_e4s:9.2::baseos
 before 0:1.5.1-15.el9_2.3
0:1.5.1-15.el9_2.3
pam
Red Hat:rhel_els:7
 before 0:1.1.8-23.el7_9.3
0:1.1.8-23.el7_9.3
pam-debuginfo
Red Hat:rhel_els:7
 before 0:1.1.8-23.el7_9.3
0:1.1.8-23.el7_9.3
pam-devel
Red Hat:rhel_els:7
 before 0:1.1.8-23.el7_9.3
0:1.1.8-23.el7_9.3
pam-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-debugsource
Red Hat:rhel_e4s:9.4::appstream
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-devel
Red Hat:rhel_e4s:9.4::appstream
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-docs
Red Hat:rhel_e4s:9.4::appstream
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam
Red Hat:rhel_e4s:9.4::baseos
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-debuginfo
Red Hat:rhel_e4s:9.4::baseos
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-debugsource
Red Hat:rhel_e4s:9.4::baseos
 before 0:1.5.1-24.el9_4.2
0:1.5.1-24.el9_4.2
pam-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam-devel
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam-libs
Red Hat:enterprise_linux_eus:10.0
 before 0:1.6.1-8.el10_0.1
0:1.6.1-8.el10_0.1
pam-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-devel
Red Hat:rhel_eus:9.6::appstream
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-docs
Red Hat:rhel_eus:9.6::appstream
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam
Red Hat:rhel_eus:9.6::baseos
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-debuginfo
Red Hat:rhel_eus:9.6::baseos
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-debugsource
Red Hat:rhel_eus:9.6::baseos
 before 0:1.5.1-26.el9_6.1
0:1.5.1-26.el9_6.1
pam-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam-devel
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam-docs
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam
Red Hat:hummingbird:1
 before 0:1.7.2-1.1.hum1
0:1.7.2-1.1.hum1
pam-devel
Red Hat:hummingbird:1
 before 0:1.7.2-1.1.hum1
0:1.7.2-1.1.hum1
pam-doc
Red Hat:hummingbird:1
 before 0:1.7.2-1.1.hum1
0:1.7.2-1.1.hum1
pam-libs
Red Hat:hummingbird:1
 before 0:1.7.2-1.1.hum1
0:1.7.2-1.1.hum1
pam
Rocky Linux:8
 before 0:1.3.1-40.el8_10
0:1.3.1-40.el8_10
pam
Rocky Linux:10
 before 0:1.6.1-9.el10_2.1
0:1.6.1-9.el10_2.1
pam
Rocky Linux:9
 before 0:1.5.1-28.el9_8.1
0:1.5.1-28.el9_8.1
pam
Root:Debian:11
 before 1.4.0-9+deb11u2.aikido.9
1.4.0-9+deb11u2.aikido.91.4.0-9+deb11u2.root.io.8
rootio-pam
Root:Debian:11
 before 1.4.0-9+deb11u2.aikido.9
1.4.0-9+deb11u2.aikido.91.4.0-9+deb11u2.root.io.8
pam
Root:Debian:12
 before 1.5.2-6+deb12u2.root.io.16
1.5.2-6+deb12u2.root.io.161.5.2-6+deb12u2.aikido.17
rootio-pam
Root:Debian:12
 before 1.5.2-6+deb12u2.root.io.16
1.5.2-6+deb12u2.root.io.161.5.2-6+deb12u2.aikido.17
pam
Root:Debian:13
 before 1.7.0-5.aikido.2
1.7.0-5.aikido.21.7.0-5.root.io.1
rootio-pam
Root:Debian:13
 before 1.7.0-5.aikido.2
1.7.0-5.aikido.21.7.0-5.root.io.1
pam
SUSE:Linux Micro 6.2
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam-full-src
SUSE:Linux Micro 6.2
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam
SUSE:Linux Enterprise Server 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam-full-src
SUSE:Linux Enterprise Server 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam-full-src
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam
SUSE:Linux Micro 6.0
 before 1.6.0-6.1
1.6.0-6.1
pam
SUSE:Linux Micro 6.1
 before 1.6.1-slfo.1.1_5.1
1.6.1-slfo.1.1_5.1
pam
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.1.8-24.80.1
1.1.8-24.80.1
pam
SUSE:Linux Enterprise Micro 5.3
 before 1.3.0-150000.6.89.1
1.3.0-150000.6.89.1
pam
SUSE:Linux Enterprise Micro 5.4
 before 1.3.0-150000.6.89.1
1.3.0-150000.6.89.1
pam
SUSE:Linux Enterprise Micro 5.5
 before 1.3.0-150000.6.89.1
1.3.0-150000.6.89.1
pam
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.3.0-150000.6.89.1
1.3.0-150000.6.89.1
pam
SUSE:Linux Enterprise Module for Development Tools 15 SP7
 before 1.3.0-150000.6.89.1
1.3.0-150000.6.89.1
pam
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.1.3-8ubuntu31.1.3-10ubuntu11.1.3-11ubuntu11.1.8-1ubuntu11.1.8-1ubuntu2
Show 5 moreShow less
1.1.8-1ubuntu2.11.1.8-1ubuntu2.21.1.8-1ubuntu2.2+esm11.1.8-1ubuntu2.2+esm31.1.8-1ubuntu2.2+esm4
 None known
pam
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.8-3.1ubuntu31.1.8-3.2ubuntu21.1.8-3.2ubuntu2.11.1.8-3.2ubuntu2.31.1.8-3.2ubuntu2.3+esm11.1.8-3.2ubuntu2.3+esm21.1.8-3.2ubuntu2.3+esm41.1.8-3.2ubuntu2.3+esm5
 None known
pam
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.8-3.2ubuntu31.1.8-3.2ubuntu41.1.8-3.6ubuntu11.1.8-3.6ubuntu21.1.8-3.6ubuntu2.18.04.1
Show 6 moreShow less
1.1.8-3.6ubuntu2.18.04.21.1.8-3.6ubuntu2.18.04.31.1.8-3.6ubuntu2.18.04.41.1.8-3.6ubuntu2.18.04.61.1.8-3.6ubuntu2.18.04.6+esm11.1.8-3.6ubuntu2.18.04.6+esm2
 None known
pam
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.1-5ubuntu11.3.1-5ubuntu31.3.1-5ubuntu41.3.1-5ubuntu4.11.3.1-5ubuntu4.2
Show 5 moreShow less
1.3.1-5ubuntu4.31.3.1-5ubuntu4.41.3.1-5ubuntu4.61.3.1-5ubuntu4.71.3.1-5ubuntu4.7+esm1
 None known
pam
Ubuntu:22.04:LTS
 before 1.4.0-11ubuntu2.7, plus listed versions
1.3.1-5ubuntu111.4.0-10ubuntu11.4.0-10ubuntu21.4.0-11ubuntu11.4.0-11ubuntu2
Show 5 moreShow less
1.4.0-11ubuntu2.11.4.0-11ubuntu2.31.4.0-11ubuntu2.41.4.0-11ubuntu2.51.4.0-11ubuntu2.6
1.4.0-11ubuntu2.7
pam
Ubuntu:24.04:LTS
 before 1.5.3-5ubuntu5.6, plus listed versions
1.5.2-6ubuntu11.5.2-9.1ubuntu11.5.2-9.1ubuntu21.5.2-9.1ubuntu31.5.3-5ubuntu3
Show 5 moreShow less
1.5.3-5ubuntu41.5.3-5ubuntu51.5.3-5ubuntu5.11.5.3-5ubuntu5.41.5.3-5ubuntu5.5
1.5.3-5ubuntu5.6
pam
Ubuntu:25.10
 All versions, plus listed versions
1.5.3-7ubuntu41.5.3-7ubuntu51.5.3-7ubuntu61.7.0-5ubuntu11.7.0-5ubuntu2
 None known
pam
Ubuntu:26.04:LTS
 before 1.7.0-5ubuntu3.1, plus listed versions
1.7.0-5ubuntu21.7.0-5ubuntu3
1.7.0-5ubuntu3.1
pam
openSUSE:Tumbleweed
 before 1.7.2+git12-2.1
1.7.2+git12-2.1
pam
openSUSE:Leap 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1
pam-full-src
openSUSE:Leap 16.0
 before 1.7.1-160000.5.1
1.7.1-160000.5.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54411 is a medium vulnerability (CVSS 6.9) in Linux-pam, published June 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in pam 1.3.1-40.el8_10.

References

Show 62 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open