CVE-2026-87816 Details
Description
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
A race condition vulnerability has been identified in PasswordPusher versions prior to 2.11.1. This vulnerability allows unauthenticated attackers to bypass the 'expire_after_views' limit on one-time secrets. Attackers can send concurrent requests to the 'show' endpoint, accessing the secret multiple times before the view count is updated and the secret expires. The issue arises because the application does not properly synchronize the process of checking view limits, delivering the secret, and logging the view, allowing for exploitation by racing requests.
Users are advised to update PasswordPusher to version 2.11.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limit-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PasswordPusher | <= 2.9.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |