Skip to content
Threat Feed
Subscribe

Product

PasswordPusher (< 2.8.1)

1 brief RSS
high advisory

CVE-2026-59802 - PasswordPusher Data URI Scheme Vulnerability Leading to Client-Side JavaScript Execution

PasswordPusher versions prior to 2.8.1 contain a client-side vulnerability (CVE-2026-59802) due to insufficient validation of URL push payloads, allowing attackers to embed malicious data URI schemes that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

PasswordPusher vulnerability web-application client-side javascript credential-theft phishing
3t 1c