Linux PAM is the pluggable authentication module framework that mediates user authentication across Unix and Linux systems, providing a narrow but foundational component to the operating system authentication layer. Despite its focused scope, the project sits prominently in the vulnerability landscape due to its role in authentication gating for virtually all user-facing access on Linux deployments. Defenders should treat PAM updates as part of their system-hardening baseline, as flaws in authentication infrastructure propagate broadly; current CVE counts, severity, and exposure details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Linux Pam over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-28321CRITICAL The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user trie | Sep 19, 2022 | 9.8 | 30 | NO | NO |
CVE-2026-54411MEDIUM Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that al | Jun 14, 2026 | 5.9 | 29 | NO | NO |
CVE-2020-27780CRITICAL A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root | Dec 18, 2020 | 9.8 | 29 | NO | NO |
CVE-2010-3853MEDIUM pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init s | Jan 24, 2011 | 6.9 | 21 | NO | NO |
CVE-2024-10041MEDIUM A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard inp | Oct 23, 2024 | 4.7 | 20 | NO | NO |
CVE-2024-22365MEDIUM linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. | Feb 6, 2024 | 5.5 | 19 | NO | NO |
CVE-2015-3238MEDIUM The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames | Aug 24, 2015 | 6.5 | 19 | NO | NO |
CVE-2009-0887MEDIUM Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might al | Mar 12, 2009 | 6.6 | 19 | NO | NO |
CVE-2010-4708HIGH The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an uninte | Jan 24, 2011 | 7.2 | 18 | NO | NO |
CVE-2014-2583MEDIUM Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly by | Apr 10, 2014 | 5.8 | 17 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Linux Pam.
Media articles that mention a CVE ID that affects a product developed by Linux Pam — matched by CVE ID, not by vendor name.