Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-61458

PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pglombardo PasswordPusher

Default version status: unaffected

  • 0 to < 2.9.2affected
  • 2.9.2unaffected
pkg:github/pglombardo/PasswordPusher

References