PasswordPusher CVE-2026-87816

The attacker must possess the specific secret URL - PasswordPusher does not expose secrets without the URL token, so URL-guessing is not a practical attack path given standard token entropy. The targeted push must have expire_after_views configured (it may be the default for some deployments, but this should be verified per installation). No authentication is required (CVSS PR:N). The exploit requires sending concurrent HTTP GET requests within the same short timing window (milliseconds to low seconds depending on server response time and database latency), which is straightforward with any HTTP concurrency tool but does require the attacker to act before a legitimate view has already consumed the push. Deployments that restrict PasswordPusher to authenticated users (via reverse proxy or built-in auth) narrow the attacker population to authenticated principals, but do not eliminate the race.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects a high-confidence, network-reachable, unauthenticated confidentiality impact, consistent with the attack's low technical barrier - concurrent HTTP requests require no specialized tooling. However, a material practical constraint exists: the attacker must already possess the secret URL, since PasswordPusher does not enumerate or expose secrets without the URL token. This means the realistic threat profile involves a malicious or compromised intended recipient, or an attacker who intercepted the URL in transit - not opportunistic mass scanning. Even a mid-sized municipal IT team in radom using PasswordPusher to distribute internal credentials should treat this as urgent, since the tool's entire value proposition (self-destructing secrets) is nullified by this flaw. EPSS data was not provided in the input, and no KEV listing or public exploit has been identified, so wide opportunistic exploitation is not a demonstrated risk at time of analysis. The principal impact is targeted: a recipient who exploits the race can read the secret an indefinite number of times and share it further without the sender's knowledge, making detection and revocation impractical.

An attacker receives a one-time secret URL and immediately dispatches dozens of parallel GET requests to the show endpoint using an HTTP concurrency tool such as a scripted thread pool or curl's parallel flag. Because the view counter read and decrement are non-atomic, multiple requests return the full secret payload before the push is marked expired, allowing the attacker to cache the secret locally and share it without the sender's knowledge. No public exploit code has been identified at time of analysis, but the technique requires no specialized knowledge beyond basic HTTP scripting.