Passwordpusher
CVE-2026-61458
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Passphrase brute-force in PasswordPusher before 2.9.2 lets remote attackers who possess a push token recover the passphrase protecting a shared secret by hammering the POST /p/:token/access endpoint. Because that route has no per-route rate limiting and no per-push lockout, an attacker can sustain roughly 120 guesses per minute, making short or dictionary-based passphrases recoverable within hours to days. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Passwordpusher gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Executive ViewAI
PasswordPusher before version 2.9.2 contains a brute-force vulnerability allowing attackers with a share link to recover weak passphrases protecting shared secrets within hours, potentially exposing credentials and sensitive data your organization intended to protect through this service.
Within 24 hours: identify any PasswordPusher deployments your organization operates, enforce strong passphrase requirements (minimum 16 random characters), and immediately implement rate limiting on the POST /p/:token/access endpoint via reverse proxy or WAF. Within 7 days: review access logs for exploitation attempts and implement alerting on excessive failed access attempts per token. Within 30 days: monitor vendor advisories for PasswordPusher patch release and upgrade to patched version immediately upon availability; evaluate alternative secret-sharing solutions with built-in rate limiting and account lockout protections.
No vendor-released patch identified at time of analysis. Interim mitigations: implement rate limiting on POST /p/:token/access endpoint (recommend maximum 10 requests per minute per token via reverse proxy or WAF); enforce strong, randomly-generated passphrases (minimum 16 characters); enable detailed access logging with alerting on suspicious patterns; temporarily restrict organizational use of PasswordPusher until vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Passwordpusher
View allPasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-
Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race
Unauthenticated attackers can create file-type pushes through Password Pusher's JSON API endpoints when the application
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create UR
Exploit-DB