CVE-2026-87816: TOCTOU Race Condition in PasswordPusher View Limit Enforcement

PasswordPusher versions before 2.11.1 contain a time-of-check-to-time-of-use (TOCTOU) race condition in the logic responsible for enforcing 'expire_after_views' limits. This vulnerability impacts the application's ability to properly invalidate one-time secrets after they have been accessed the configured number of times. By sending high-concurrency requests to the show endpoint, an unauthenticated attacker can retrieve a secret multiple times before the backend application process increments the view counter and marks the object as expired. This failure in synchronization effectively neutralizes the primary security feature of the PasswordPusher platform, which is designed to ensure sensitive data is only viewed once or a limited number of times. Defenders should prioritize patching, as this vulnerability allows for the unauthorized extraction of credentials or secrets that were intended to be transient.

Impact

Successful exploitation allows unauthenticated users to bypass security controls designed to limit secret access. This leads to the unauthorized exfiltration of sensitive information, such as credentials or API keys, stored in PasswordPusher, violating the intended data expiration policies. Any organization utilizing PasswordPusher for secure transmission of secrets is at risk of credential theft if an attacker has visibility into the secret links.

Recommendation

• Upgrade all PasswordPusher instances to version 2.11.1 or later to remediate the TOCTOU race condition in the view limit enforcement logic.
• Review access logs for the 'show' endpoint to identify patterns of high-frequency or concurrent requests from single IP addresses targeting the same secret URL, which may indicate exploitation attempts.
• Implement rate-limiting at the reverse proxy or WAF layer to mitigate the impact of high-concurrency request floods used to trigger race conditions.