Which versions of Passwordpusher are affected by CVE-2026-61458?

PasswordPusher before version 2.9.2 contains a brute-force vulnerability allowing attackers with a share link to recover weak passphrases protecting shared secrets within hours, potentially exposing…

How to fix or mitigate CVE-2026-61458?

Within 24 hours: identify any PasswordPusher deployments your organization operates, enforce strong passphrase requirements (minimum 16 random characters), and immediately implement rate limiting on the POST /p/:token/access endpoint via reverse proxy or WAF. Within 7 days: review access logs for exploitation attempts and implement alerting on excessive failed access attempts per token. Within 30 days: monitor vendor advisories for PasswordPusher patch release and upgrade to patched version immediately upon availability; evaluate alternative secret-sharing solutions with built-in rate limiting and account lockout protections.

Passwordpusher CVE-2026-61458

Q: What is the CVSS score of CVE-2026-61458?

CVE-2026-61458 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-07-13 VulnCheck

Information Disclosure Passwordpusher

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:01 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 8.7

DescriptionCVE.org

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.

AnalysisAI

Passphrase brute-force in PasswordPusher before 2.9.2 lets remote attackers who possess a push token recover the passphrase protecting a shared secret by hammering the POST /p/:token/access endpoint. Because that route has no per-route rate limiting and no per-push lockout, an attacker can sustain roughly 120 guesses per minute, making short or dictionary-based passphrases recoverable within hours to days. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: identify any PasswordPusher deployments your organization operates, enforce strong passphrase requirements (minimum 16 random characters), and immediately implement rate limiting on the POST /p/:token/access endpoint via reverse proxy or WAF. …

Threat intelligence, references, and detailed analysis are available after sign-in.