From eec3164b417a7f204ea6b724a135b65c0cfcc8c0 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 15 Jun 2026 18:27:06 +0200
Subject: [PATCH] xauth-pam: Avoid race for multiple concurrent authentication
 attempts

The previously static pam_conv instance could get reused by multiple
threads, causing one to use the password of the other.
---
 src/libcharon/plugins/xauth_pam/xauth_pam.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libcharon/plugins/xauth_pam/xauth_pam.c b/src/libcharon/plugins/xauth_pam/xauth_pam.c
index 1f6e6b641..f04a1b0d4 100644
--- a/src/libcharon/plugins/xauth_pam/xauth_pam.c
+++ b/src/libcharon/plugins/xauth_pam/xauth_pam.c
@@ -77,13 +77,13 @@ static int auth_conv(int num_msg, const struct pam_message **msg,
  */
 static bool authenticate(char *service, char *user, char *password)
 {
+	struct pam_conv conv = {
+		.conv = (void*)auth_conv,
+		.appdata_ptr = password,
+	};
 	pam_handle_t *pamh = NULL;
-	static struct pam_conv conv;
 	int ret;
 
-	conv.conv = (void*)auth_conv;
-	conv.appdata_ptr = password;
-
 	ret = pam_start(service, user, &conv, &pamh);
 	if (ret != PAM_SUCCESS)
 	{