What’s Vulnerable › Vulnerabilities

CVE-2026-61458: PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-13 · updated 2026-10-24
• Weakness: CWE-307

Description

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.

Affected products

• pglombardo PasswordPusher: before 2.9.2 — fixed in 2.9.2

How to fix

Upgrade to a fixed version: pglombardo PasswordPusher 2.9.2. Check the vendor advisory for mitigations.

References

• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw
• https://www.vulncheck.com/advisories/passwordpusher-passphrase-brute-force-via-unthrottled-endpoint
• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw

Get alerted when CVE-2026-61458 or the next vulnerability affects your stack