CVE-2026-87816 — PasswordPusher before 2.11.1 Race Condition View Limit Bypass
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views …
Published: 2026-09-09 · CVSS: 8.7 · CVSS 4.0
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7