CVE-2020-27780

9.8 criticalEPSS 2.0%

Critical (9.8) in linux-pam linux-pam. EPSS 2.0% chance of exploitation in the next 30 days.

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2020-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

linux-pam:linux-pam

References

https://bugzilla.redhat.com/show_bug.cgi?id=1901094
https://bugzilla.redhat.com/show_bug.cgi?id=1901094

Check your stack JSON