CVE-2026-87816

High

Description

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.

SeverityHigh

CVSS7.5

Exploit probability—

ProductPasswordPusher

PublishedSep 9, 2026

First seenSep 9, 2026

Weakness typeCWE-362Race condition

How to fix

Update

pglombardo PasswordPusher2.11.1 or later

Vendor advisories

github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp

Affected products

Product	Affected versions	Fixed in
pglombardo PasswordPusher	v < 2.11.1	2.11.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.