CVE-2026-61458 — PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. A…
Published: 2026-07-13 · CVSS: 8.7 · CVSS 4.0
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7