Passwordpusher
CVE-2026-61458
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
AnalysisAI
Passphrase brute-force in PasswordPusher before 2.9.2 lets remote attackers who possess a push token recover the passphrase protecting a shared secret by hammering the POST /p/:token/access endpoint. Because that route has no per-route rate limiting and no per-push lockout, an attacker can sustain roughly 120 guesses per minute, making short or dictionary-based passphrases recoverable within hours to days. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
More in Passwordpusher
View allPasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-
Unauthenticated attackers can create file-type pushes through Password Pusher's JSON API endpoints when the application
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create UR
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today