Name: CVE-2026-54411: Observable Timing Discrepancy
Creator: Rapid7
Published: 2026-06-14T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-54411, CWE-208, CVSS 5.9, EPSS 0.0032

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

CVSS Details

CVSS 4.0 Base Score: 6.9 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X)
CVSS 3.1 Base Score: 5.9
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade pamUpgrade pam-develUpgrade pam-docs	Oct 11, 2026	Aug 18, 2026
Oracle_linux	—	Upgrade pamUpgrade pam-docsUpgrade pam-libsUpgrade pam-devel	Oct 22, 2026	Jun 14, 2026
Redhat_linux	—	Upgrade pamUpgrade pam-libsUpgrade pam-docsUpgrade pam-debugsourceNo solution existsUpgrade pam-libs-debuginfoUpgrade pam-debuginfoUpgrade pam-devel	Jul 17, 2026	Jun 14, 2026
Rocky_linux	—	Upgrade pam-docsUpgrade pam-libsUpgrade pam-debugsourceUpgrade pam-develUpgrade pamUpgrade pam-debuginfoUpgrade pam-libs-debuginfo	Aug 20, 2026	Aug 19, 2026
Ubuntu	—	Upgrade libpam-modules	Jul 26, 2026	Jul 23, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence