CVE-2026-87816: PasswordPusher Race Condition Vulnerability

CVE-2026-87816 Overview

CVE-2026-87816 is a time-of-check-to-time-of-use (TOCTOU) race condition [CWE-362] in PasswordPusher versions before 2.11.1. The flaw resides in the view limit enforcement logic that governs how many times a shared secret can be retrieved. Unauthenticated attackers can send concurrent requests to the show endpoint and access one-time secrets multiple times before the view counter increments and the push expires. The vulnerability undermines the core confidentiality guarantee of the application, which is designed to expose sensitive credentials only for a bounded number of retrievals.

Critical Impact
Remote, unauthenticated attackers can bypass expire_after_views limits and repeatedly read one-time secrets that should be single-use, breaking confidentiality of shared credentials.

Affected Products

PasswordPusher versions prior to 2.11.1
Self-hosted PasswordPusher deployments running vulnerable releases
Any integration or automation relying on expire_after_views for secret confidentiality

Discovery Timeline

2026-09-09 - CVE-2026-87816 published to the National Vulnerability Database
2026-09-09 - Record last modified in NVD

Technical Details for CVE-2026-87816

Vulnerability Analysis

PasswordPusher lets users share secrets that expire after a configured number of views. The show endpoint checks the current view count, returns the payload if the limit has not been reached, and then increments the counter. Because the check and the update are not performed atomically, concurrent requests can each pass the check before any of them commits the increment. This is a classic TOCTOU race condition where the state read during validation is stale by the time enforcement occurs.

The practical outcome is a bypass of the expire_after_views control. A secret intended to be retrievable once can be retrieved several times if the attacker parallelizes requests. Because PasswordPusher is commonly used to transmit passwords, API keys, and other bootstrap credentials, silent extra retrievals can expose credentials to attackers without alerting the sender or recipient that the secret has been read more than expected.

Root Cause

The root cause is the absence of an atomic operation or serializing lock around the read-check-increment sequence for the view counter. Without a database-level atomic update, transactional isolation at a sufficient level, or an application-level mutex keyed on the push identifier, multiple worker threads or processes can service concurrent requests against the same push and each observe a view count below the limit.

Attack Vector

Exploitation requires only network reachability to the vulnerable PasswordPusher instance and knowledge of a valid push URL token. The attacker issues multiple concurrent HTTP requests to the show endpoint for the target push. Depending on server concurrency, several of those requests return the plaintext secret before any request commits the view increment that would mark the push expired.

No authentication, user interaction, or elevated privileges are required. See the GitHub Security Advisory GHSA-6q3c-57pp-wvpp and the VulnCheck Advisory: PasswordPusher Race Condition for further technical detail. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-87816

Indicators of Compromise

Multiple successful GET responses to the same /p/<token> or show endpoint within a very short time window from one or more source addresses.
Application logs showing view counts advancing by more than one per logical retrieval, or pushes marked expired immediately after multiple 200 responses.
Web server access logs with clustered, near-simultaneous requests for the same push token from parallelized clients.

Detection Strategies

Correlate reverse-proxy or load balancer logs to identify concurrent requests targeting the same push identifier from the same client or IP range.
Alert on any push where the returned view count in the response body exceeds the configured expire_after_views value, indicating the race has fired.
Review database records where a push transitioned from active to expired within a very small time delta after receiving multiple show requests.

Monitoring Recommendations

Enable verbose request logging on the PasswordPusher application and forward logs to a centralized analytics platform for retrospective hunting.
Track baseline retrieval patterns per push and flag deviations such as multiple retrievals within the same second.
Monitor for automation signals such as scripted user agents or high request rates targeting show endpoints.

How to Mitigate CVE-2026-87816

Immediate Actions Required

Upgrade all PasswordPusher instances to version 2.11.1 or later without delay.
Invalidate any currently active pushes that were created on vulnerable versions and rotate the underlying credentials they contained.
Audit historical access logs for signs of concurrent retrievals against the same push token before patching.

Patch Information

The fix is available in PasswordPusher 2.11.1. Refer to the GitHub Security Advisory GHSA-6q3c-57pp-wvpp for release details and remediation guidance. Administrators should apply the update to all self-hosted deployments and verify the running version after upgrade.

Workarounds

Place PasswordPusher behind a reverse proxy configured to rate-limit or serialize requests to /p/<token> and show endpoints per push identifier.
Reduce application concurrency temporarily by lowering worker or thread counts so that the race window is minimized until the patch can be applied.
Instruct users to treat all shared secrets as potentially disclosed if pushes were served by a vulnerable version, and rotate credentials on delivery rather than relying on expire_after_views.

bash

# Configuration example: verify the installed PasswordPusher version
docker inspect --format '{{.Config.Image}}' passwordpusher
docker exec passwordpusher cat VERSION || docker exec passwordpusher printenv APP_VERSION

# Upgrade to the patched release
docker pull pglombardo/pwpush:v2.11.1
docker stop passwordpusher && docker rm passwordpusher
docker run -d --name passwordpusher pglombardo/pwpush:v2.11.1