CVE-2026-54411CWE-208

CVE-2026-54411

Medium · published June 14, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2026-06-14T22:17Z
References (4)
https://cwe.mitre.org/data/definitions/208.html · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/linux-pam/linux-pam · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 14 JUN 17:21Z
    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in…
    cvelistv5