A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0473 advisory.

    This advisory aggregates security fixes for the pam SRPM in CIQ LTS 9.2. It addresses 9 CVEs:
    CVE-2025-6020, CVE-2020-27780, CVE-2010-3435, CVE-2014-2583, CVE-2009-0579, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-
    existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty
    password it successfully authenticate. (CVE-2020-27780)

fix CVE-2020-27780: authentication bypass when the user doesn't exist

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202012-06 (Linux-PAM: Authentication bypass)

    A flaw was found in Linux-Pam in the way it handle empty passwords for       non-existing users.
  Impact :

    A remote attacker, who only needs to know a non-existing username, could       bypass security restrictions and authenticate as root user.
  Workaround :

    Ensure that root account is protected by a non-empty password.

ID	Name	Product	Family	Type	Severity
355488	Rocky Linux 9.2 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs Multiple Vulnerabilities (ciqsa-2026_0473)	Nessus	Rocky Linux Local Security Checks	Local	critical
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
144091	Fedora 32 : pam (2020-bd83344365)	Nessus	Fedora Local Security Checks	Local	critical
143493	GLSA-202012-06 : Linux-PAM: Authentication bypass	Nessus	Gentoo Local Security Checks	Local	critical
143326	Fedora 33 : pam (2020-22532a1a81)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-27780

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical