high7.5
CVE-2026-61458
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push loc…
Impact
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Affected products
| Product | Affected versions |
|---|---|
| PasswordPusher | before 2.9.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.