USN-8688-1
pam vulnerability
Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first performing authentication. An attacker could possibly use this issue to reset failed login counters, resulting in authentication lockout restrictions being bypassed.
What each source reports
OSV No score
pam vulnerability
Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first performing authentication. An attacker could possibly use this issue to reset failed login counters, resulting in authentication lockout restrictions being bypassed.
- Record
USN-8688-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pamUbuntu:Pro:18.04:LTS |
before 1.1.8-3.6ubuntu2.18.04.6+esm2, plus listed versions 1.1.8-3.2ubuntu31.1.8-3.2ubuntu41.1.8-3.6ubuntu11.1.8-3.6ubuntu21.1.8-3.6ubuntu2.18.04.1 Show 5 moreShow less1.1.8-3.6ubuntu2.18.04.21.1.8-3.6ubuntu2.18.04.31.1.8-3.6ubuntu2.18.04.41.1.8-3.6ubuntu2.18.04.61.1.8-3.6ubuntu2.18.04.6+esm1 |
1.1.8-3.6ubuntu2.18.04.6+esm2 |
pamUbuntu:Pro:20.04:LTS |
before 1.3.1-5ubuntu4.7+esm1, plus listed versions 1.3.1-5ubuntu11.3.1-5ubuntu31.3.1-5ubuntu41.3.1-5ubuntu4.11.3.1-5ubuntu4.2 Show 4 moreShow less1.3.1-5ubuntu4.31.3.1-5ubuntu4.41.3.1-5ubuntu4.61.3.1-5ubuntu4.7 |
1.3.1-5ubuntu4.7+esm1 |
pamUbuntu:22.04:LTS |
before 1.4.0-11ubuntu2.8, plus listed versions 1.3.1-5ubuntu111.4.0-10ubuntu11.4.0-10ubuntu21.4.0-11ubuntu11.4.0-11ubuntu2 Show 6 moreShow less1.4.0-11ubuntu2.11.4.0-11ubuntu2.31.4.0-11ubuntu2.41.4.0-11ubuntu2.51.4.0-11ubuntu2.61.4.0-11ubuntu2.7 |
1.4.0-11ubuntu2.8 |
pamUbuntu:24.04:LTS |
before 1.5.3-5ubuntu5.7, plus listed versions 1.5.2-6ubuntu11.5.2-9.1ubuntu11.5.2-9.1ubuntu21.5.2-9.1ubuntu31.5.3-5ubuntu3 Show 6 moreShow less1.5.3-5ubuntu41.5.3-5ubuntu51.5.3-5ubuntu5.11.5.3-5ubuntu5.41.5.3-5ubuntu5.51.5.3-5ubuntu5.6 |
1.5.3-5ubuntu5.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8688-1 is a vulnerability with no CVSS score yet in pam, published August 27, 2026. No source lists public exploit code. Fixed in pam 1.1.8-3.6ubuntu2.18.04.6+esm2.