What is CVE-2026-54411?

CVE-2026-54411 is a medium-severity vulnerability in Linux-pam, classified under CWE-208. CVSS score: 5.9/10. Published 2026-06-14.

How severe is CVE-2026-54411?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Linux-pam

CVE-2026-54411

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedl…

EPSS: 0.003 (25.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Linux-pam — versions 0

Weakness classification (CWE)

CWE-208

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (technical-description)
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (product)
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (product)
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (product)

Frequently asked questions

What is CVE-2026-54411?: CVE-2026-54411 is a medium-severity vulnerability in Linux-pam, classified under CWE-208. CVSS score: 5.9/10. Published 2026-06-14.
How severe is CVE-2026-54411?: Medium severity. CVSS v3 base score is 5.9 out of 10.