high7.5
CVE-2026-87816
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass e…
Impact
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Affected products
| Product | Affected versions |
|---|---|
| PasswordPusher | before 2.11.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.