oath-toolkit[1] contains libraries and utilities for managing one-time password (OTP) authentication e.g. as a second factor to password authentication. A couple of years ago, the module gained a feature which allows to place the OTP state file (called usersfile) in the home directory of the to-be-authenticated user. Fabian noticed that the PAM module performs unsafe file operations in users' home directories. Since PAM stacks typically run as root, this can easily cause security issues. The feature in question has been introduced in oath-toolkit version 2.6.7 (via commit 60d9902b5c [2]). The following report is based on the most recent oath-toolkit release tag for version 2.6.11.