CVE-2026-59802: PasswordPusher XSS Vulnerability

CVE-2026-59802 Overview

CVE-2026-59802 is a redirect-based cross-site scripting (XSS) vulnerability in PasswordPusher before version 2.8.1. The application's valid_url function fails to properly validate URL schemes in URL push payloads, allowing data: URI schemes to be accepted. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in a victim's browser when the push link is clicked. Because the malicious content is delivered under the trusted PasswordPusher domain, the vulnerability enables convincing phishing attacks and credential theft. The issue is classified under [CWE-183] (Permissive List of Allowed Inputs).

Critical Impact
Attackers can execute arbitrary JavaScript in victims' browsers under the trusted PasswordPusher origin, enabling phishing and credential theft against users who click shared push URLs.

Affected Products

PasswordPusher versions prior to 2.8.1
Self-hosted PasswordPusher deployments using the URL push feature
Managed PasswordPusher instances running vulnerable releases

Discovery Timeline

2026-07-08 - CVE-2026-59802 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59802

Vulnerability Analysis

PasswordPusher provides a URL push feature that stores a user-supplied URL and redirects recipients to that destination when they visit the generated push link. The valid_url function is responsible for restricting acceptable URL schemes. Insufficient validation allows the data: scheme through the filter, treating it as a legitimate redirect target.

When a recipient opens the push link, the server responds with a redirect to the attacker-controlled data:text/html URI. The browser then renders inline HTML and executes any embedded JavaScript. The executed script runs in a browsing context associated with the PasswordPusher domain in the user's mind, creating a high-trust surface for phishing forms and credential harvesting.

Root Cause

The root cause is a permissive URL scheme allow-list in the valid_url function. The validator does not reject non-navigational schemes such as data:, javascript:, or other schemes capable of executing script content. This maps directly to [CWE-183], where insufficiently restrictive input filtering allows dangerous values to pass validation.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker creates a URL push with a payload of the form data:text/html;base64,<encoded HTML with script>. The attacker distributes the resulting PasswordPusher link through email, chat, or other channels. When a victim clicks the link, PasswordPusher redirects the browser to the data: URI, which renders the attacker's HTML and executes JavaScript. The attacker can display a spoofed login page, exfiltrate typed credentials, or perform other client-side actions. See the GitHub Security Advisory GHSA-76c2-66pg-fj2f and the VulnCheck Advisory for full technical details.

Detection Methods for CVE-2026-59802

Indicators of Compromise

URL push records in the PasswordPusher database whose target URL begins with data:, javascript:, vbscript:, or other non-HTTP schemes.
Web server access logs showing outbound redirects (HTTP 302) with Location: headers containing data:text/html values.
User reports of PasswordPusher links that display login prompts or unexpected content instead of navigating to a normal web page.

Detection Strategies

Query the PasswordPusher urls table for stored payloads matching ^(?!https?://) to identify suspicious non-HTTP schemes.
Inspect reverse proxy or load balancer logs for responses to /r/* (or equivalent push retrieval endpoints) containing data: in the Location response header.
Correlate access to push URLs with subsequent user reports of phishing or credential compromise.

Monitoring Recommendations

Enable audit logging on push creation events and alert on payloads containing data:, javascript:, file:, or blob: schemes.
Monitor for anomalous spikes in URL push creation from a single account, which may indicate abuse for mass phishing.
Track outbound redirect destinations and flag those that do not resolve to HTTP or HTTPS origins.

How to Mitigate CVE-2026-59802

Immediate Actions Required

Upgrade PasswordPusher to version 2.8.1 or later on all self-hosted and managed instances.
Audit existing URL push records for data:, javascript:, or other non-HTTP scheme payloads and delete any suspicious entries.
Notify users who may have clicked recent URL push links and rotate credentials for any accounts that may have been phished.

Patch Information

The PasswordPusher maintainers addressed the vulnerability in release 2.8.1 by tightening scheme validation in the valid_url function to accept only http:// and https:// URLs. Details are available in GitHub Security Advisory GHSA-76c2-66pg-fj2f.

Workarounds

If patching cannot be performed immediately, disable the URL push feature via configuration to prevent creation of new URL pushes.
Deploy a reverse proxy rule that inspects the Location header on push redirect responses and blocks values not matching ^https?://.
Apply a Content Security Policy that restricts navigation and framing to trusted origins to reduce the impact of successful redirects.

bash

# Example reverse proxy filter (nginx) to block data: redirects from PasswordPusher
location /r/ {
    proxy_pass http://passwordpusher_upstream;
    proxy_hide_header Location;
    add_header Location $upstream_http_location;
    if ($upstream_http_location ~* "^(data|javascript|vbscript|file|blob):") {
        return 403;
    }
}