CVE-2026-61458: PasswordPusher Auth Bypass Vulnerability

CVE-2026-61458 Overview

CVE-2026-61458 is a brute-force vulnerability in PasswordPusher versions before 2.9.2. The flaw resides in the POST /p/:token/access endpoint, which lacks route-specific rate limiting and per-push lockout mechanisms. An attacker who possesses a valid push token can submit passphrase guesses at approximately 120 attempts per minute without triggering any push-level defense. Short passphrases and passphrases derived from dictionary words become practically recoverable within hours to days. The weakness is classified under [CWE-307: Improper Restriction of Excessive Authentication Attempts]. Because push tokens are frequently shared over channels such as email or chat, exposure of a token is common and directly enables the brute-force path against the protected secret.

Critical Impact
Attackers with knowledge of a push token can recover weak passphrases and access the shared secret, resulting in disclosure of credentials or sensitive data intended for restricted delivery.

Affected Products

PasswordPusher versions prior to 2.9.2

Discovery Timeline

2026-07-13 - CVE-2026-61458 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61458

Vulnerability Analysis

PasswordPusher allows users to share secrets protected by an optional passphrase. Access to a protected push requires the requester to supply the correct passphrase to the POST /p/:token/access endpoint. The endpoint validates the submitted passphrase against the value stored for the push identified by :token.

The implementation does not apply route-specific throttling to this endpoint, nor does it lock a push after a configurable number of failed passphrase attempts. As a result, an attacker who has obtained the push token can iterate through candidate passphrases at high volume. Measured throughput reaches roughly 120 attempts per minute against a single push, and parallel requests further increase effective guess rates.

The scope of impact is confined to the confidentiality of the shared secret. The vulnerability does not directly compromise integrity or availability of the PasswordPusher service, but the recovered secret may itself be a password or key that unlocks downstream systems.

Root Cause

The root cause is missing enforcement of authentication attempt limits on the passphrase verification route. Application-wide protections, where present, do not apply granular per-push counters or exponential backoff. Weak or human-memorable passphrases fall within reach of offline-equivalent guessing rates.

Attack Vector

Exploitation requires network access to the PasswordPusher instance and knowledge of the target push token. The token is typically embedded in the shared URL. Attackers automate HTTP POST requests to /p/:token/access with candidate passphrases from wordlists, common patterns, or brute-force character sets. No user interaction and no prior authentication to the PasswordPusher application are required.

The vulnerability is described in prose only; refer to the VulnCheck Advisory on PasswordPusher and the GitHub Security Advisory for further technical detail.

Detection Methods for CVE-2026-61458

Indicators of Compromise

High volumes of POST requests to /p/:token/access originating from a single client or a small set of IP addresses within short time windows.
Repeated HTTP 401 or 403 responses from the passphrase verification endpoint for the same push token.
Access to a push followed immediately by a burst of failed attempts against unrelated tokens from the same source.

Detection Strategies

Parse web server or reverse proxy logs for request rates against /p/*/access that exceed baseline user behavior.
Correlate failed passphrase responses per token and per source IP over rolling one-minute and one-hour windows.
Alert when a single push token receives more than a small threshold of failed access attempts, which is uncommon for legitimate recipients.

Monitoring Recommendations

Ship PasswordPusher application logs, Rails logs, and fronting proxy logs to a centralized log platform for correlation.
Retain access logs for the /p/:token/access route for at least 30 days to support retroactive investigation once a token compromise is suspected.
Track outbound notifications and email delivery to detect unauthorized reads of shared secrets following suspicious activity.

How to Mitigate CVE-2026-61458

Immediate Actions Required

Upgrade PasswordPusher to version 2.9.2 or later, which introduces route-specific rate limiting and per-push lockout logic.
Rotate any secrets pushed through vulnerable versions if pushes remained active and reachable by unauthenticated clients.
Reduce the default expiration window and view count for pushes to shrink the exposure period for any single token.

Patch Information

The fix is included in PasswordPusher 2.9.2. Details are documented in the GitHub Security Advisory GHSA-59w3-h5v2-c4xw. Administrators running self-hosted deployments should update container images, gems, and dependent services, then restart the application.

Workarounds

Enforce request rate limiting at the reverse proxy or web application firewall (WAF) for the /p/:token/access route until the upgrade is completed.
Require long, high-entropy passphrases through operational policy so that guessing remains infeasible even at 120 attempts per minute.
Restrict network access to the PasswordPusher instance using IP allowlists or authenticated ingress where the deployment model permits.

bash

# Example NGINX rate-limit configuration for the vulnerable route
http {
    limit_req_zone $binary_remote_addr zone=pp_access:10m rate=5r/m;

    server {
        location ~ ^/p/[^/]+/access$ {
            limit_req zone=pp_access burst=3 nodelay;
            proxy_pass http://passwordpusher_upstream;
        }
    }
}