CVE-2026-54411

A flaw was found in Linux-PAM's pam_userdb module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the pam_userdb module is configured to store and compare credentials in plaintext, which is not a default setting.

This Moderate flaw in Linux-PAM's pam_userdb module allows a local or network-adjacent attacker to recover plaintext passwords through a timing discrepancy. This vulnerability requires the pam_userdb module to be explicitly configured to store and compare credentials in plaintext, which is not a default or recommended configuration in Red Hat Enterprise Linux environments. The impact is limited by the need for repeated authentication attempts and specific, non-default module configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should ensure that the pam_userdb module is not configured to store or compare credentials in plaintext. Verify that pam_userdb is either configured with a strong cryptographic hashing method or, if not required, is disabled. Avoid using crypt=none or omitting the crypt= argument when configuring pam_userdb. If changes are made to PAM configuration files, services relying on PAM may need to be restarted for the changes to take effect.