Bug 514391 - plasmalogin leaks typed password to TTY1
Summary: plasmalogin leaks typed password to TTY1
Status: NEEDSINFO WAITINGFORINFO
Alias: None
Product: plasma-login-manager
Classification: Plasma
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Other Linux
: NOR major
Target Milestone: ---
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-09 22:58 UTC by Szczepan Hołyszewski
Modified: 2026-01-14 14:22 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
Password leaked to TTY1 (1.97 MB, image/jpeg)
2026-01-09 23:00 UTC, Szczepan Hołyszewski
Details
Diagnostics captured in plasmalogin session (19.19 KB, text/plain)
2026-01-10 01:15 UTC, Szczepan Hołyszewski
Details
Diagnostics captured in SDDM session, for reference (18.93 KB, text/plain)
2026-01-10 01:16 UTC, Szczepan Hołyszewski
Details
systemctl status plasmalogin (1.45 KB, text/plain)
2026-01-10 17:26 UTC, Szczepan Hołyszewski
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Szczepan Hołyszewski 2026-01-09 22:58:57 UTC
SUMMARY

`plasmalogin` blatantly leaks the typed password to TTY1.

STEPS TO REPRODUCE
1. Enable plasmalogin
2. Reboot and log in
3. Switch to tty1

OBSERVED RESULT

Terminal login is running on tty1, and my password that I typed in the plasmalogin greeter is openly visible on tty1 as if typed on the username prompt, as shown (pixelated) on the attached screenshot.

EXPECTED RESULT

No password leakage.

SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 6.5.4
KDE Frameworks Version: 6.21.0
Qt Version: 6.11.0
Kernel Version: 6.18.4-arch1-1 (64-bit)
Graphics Platform: Wayland
Processors: 12 × Intel® Core™ i7-8700 CPU @ 3.20GHz
Memory: 32 GiB of RAM (31.3 GiB usable)
Graphics Processor: NVIDIA GeForce GTX 960

ADDITIONAL INFORMATION

This has been consistently reproducible for a while, and I've been retrying monthly to see if this issue was fixed, understanding that plasmalogin was still in beta. Now that it is about to land in Plasma 6.6, it's probably the right time to raise alarm about this.
Comment 1 Szczepan Hołyszewski 2026-01-09 23:00:33 UTC
Created attachment 188366 [details]
Password leaked to TTY1
Comment 2 Oliver Beard 2026-01-09 23:04:41 UTC
This doesn't happen on my Arch Linux install. Is this using the AUR package? After login, TTY1 shows the systemd bootup and TTY2 shows the login session. There is never any console login prompt.
Comment 3 Szczepan Hołyszewski 2026-01-10 01:15:18 UTC
(In reply to Oliver Beard from comment #2)
> This doesn't happen on my Arch Linux install. Is this using the AUR package?
> After login, TTY1 shows the systemd bootup and TTY2 shows the login session.
> There is never any console login prompt.

AUR package `plasma-login-manager-git`.

I might have done some TTY/console tweaking in the past and I may have things running on TTY1 that doesn't run there in a stock Arch. But this probably only surfaces the issue rather than causes it.

With SDDM, TTY1 has black screen with mouse pointer, TTY2 has console login (no password leaking there), and TTY3 runs the Plasma session.

With plasmalogin, TTY1 has what the screenshot shows, TTY2 has whatever desktop session plasmalogin starts, and TTY3 has console login prompt.

I vibecoded a script that gathers some diagnostics and ran it both in a SDDM session and in a plasmalogin session. Attaching the diagnostics.

In any case, I believe a proper greeter should prevent keyboard input from spilling over.
Comment 4 Szczepan Hołyszewski 2026-01-10 01:15:56 UTC
Created attachment 188369 [details]
Diagnostics captured in plasmalogin session
Comment 5 Szczepan Hołyszewski 2026-01-10 01:16:34 UTC
Created attachment 188370 [details]
Diagnostics captured in SDDM session, for reference
Comment 6 David Edmundson 2026-01-10 13:52:53 UTC
Can you try this branch: 
work/d_ed/tty
Comment 7 Szczepan Hołyszewski 2026-01-10 17:23:59 UTC
(In reply to David Edmundson from comment #6)
> Can you try this branch: 
> work/d_ed/tty

Greeter doesn't show. Attaching plasmalogin status captured after console login.
Comment 8 Szczepan Hołyszewski 2026-01-10 17:26:59 UTC
Created attachment 188391 [details]
systemctl status plasmalogin

Built from commit 681b65b4ddc8f820a0e2d3a13a27b9fc112fbe88
Comment 9 Bug Janitor Service 2026-01-11 21:53:21 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-login-manager/-/merge_requests/56
Comment 10 Neal Gompa 2026-01-11 22:41:26 UTC
Git commit 99ded959c822c39819c15d60bcec67f2e4129673 by Neal Gompa, on behalf of David Edmundson.
Committed on 11/01/2026 at 22:17.
Pushed by ngompa into branch 'master'.

usersession: Always load the relevant VT

The old code had a relic path for when SDDM used to start the X11
server. This is no longer relevant and the checks missed handling a
wayland greeter.

M  +33   -40   src/helper/UserSession.cpp

https://invent.kde.org/plasma/plasma-login-manager/-/commit/99ded959c822c39819c15d60bcec67f2e4129673
Comment 11 Szczepan Hołyszewski 2026-01-14 14:22:28 UTC
(In reply to Neal Gompa from comment #10)
> Git commit 99ded959c822c39819c15d60bcec67f2e4129673 by Neal Gompa, on behalf
> of David Edmundson.
> Committed on 11/01/2026 at 22:17.
> Pushed by ngompa into branch 'master'.
> 
> usersession: Always load the relevant VT
> 
> The old code had a relic path for when SDDM used to start the X11
> server. This is no longer relevant and the checks missed handling a
> wayland greeter.
> 
> M  +33   -40   src/helper/UserSession.cpp
> 
> https://invent.kde.org/plasma/plasma-login-manager/-/commit/
> 99ded959c822c39819c15d60bcec67f2e4129673

Is this the same as the current 5.5.90 beta with respect to these code paths? This now can't log me in at all. Greeter shows, but no pointer, no reaction to input, and crashes/exits all by itself after a while.

```
-- Boot 95794f7536104141b334809576cd759b --
Jan 14 14:20:40 berbelek plasmalogin[1076]: Initializing...
Jan 14 14:20:40 berbelek plasmalogin[1076]: Starting...
Jan 14 14:20:40 berbelek plasmalogin[1076]: Logind interface found
Jan 14 14:20:40 berbelek plasmalogin[1076]: Adding new display...
Jan 14 14:20:40 berbelek plasmalogin[1076]: Using VT 1
Jan 14 14:20:40 berbelek plasmalogin[1076]: Display server started.
Jan 14 14:20:40 berbelek plasmalogin[1076]: Socket server starting...
Jan 14 14:20:40 berbelek plasmalogin[1076]: Socket server started.
Jan 14 14:20:40 berbelek plasmalogin[1076]: Greeter starting...
Jan 14 14:20:41 berbelek plasmalogin[1076]: Greeter session started successfully
Jan 14 14:20:42 berbelek plasmalogin[1076]: Message received from greeter: Connect
Jan 14 14:20:44 berbelek plasmalogin[1076]: Auth: plasmalogin-helper exited with 1
Jan 14 14:20:44 berbelek plasmalogin[1076]: Greeter stopped. PLASMALOGIN::Auth::HELPER_AUTH_ERROR
Jan 14 14:25:37 berbelek plasmalogin[1076]: Signal received: SIGTERM
Jan 14 14:25:37 berbelek plasmalogin[1076]: Socket server stopping...
Jan 14 14:25:37 berbelek plasmalogin[1076]: Socket server stopped.
```