USN-8688-2
pam vulnerability
USN-8688-1 fixed a vulnerability in PAM. This update provides the corresponding fix for PAM on Ubuntu 26.04 LTS.
Original advisory details:
Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first performing authentication. An attacker could possibly use this issue to reset failed login counters, resulting in authentication lockout restrictions being bypassed.
What each source reports
OSV No score
pam vulnerability
USN-8688-1 fixed a vulnerability in PAM. This update provides the corresponding fix for PAM on Ubuntu 26.04 LTS.
Original advisory details:
Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first performing authentication. An attacker could possibly use this issue to reset failed login counters, resulting in authentication lockout restrictions being bypassed.
- Record
USN-8688-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pamUbuntu:26.04:LTS |
before 1.7.0-5ubuntu3.2, plus listed versions 1.7.0-5ubuntu21.7.0-5ubuntu31.7.0-5ubuntu3.1 |
1.7.0-5ubuntu3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8688-2 is a vulnerability with no CVSS score yet in pam, published September 1, 2026. No source lists public exploit code. Fixed in pam 1.7.0-5ubuntu3.2.