HIGH 8.7 NVD
CVE-2026-87816
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass ex
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp
- https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limi
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-09 via NVD.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.