Skip to content
Threat Feed
Subscribe

Vendor

PasswordPusher

2 briefs RSS
high advisory

CVE-2026-87816: TOCTOU Race Condition in PasswordPusher View Limit Enforcement

PasswordPusher versions prior to 2.11.1 contain a race condition in view limit enforcement, allowing unauthenticated attackers to bypass 'expire_after_views' restrictions and access one-time secrets multiple times through concurrent requests.

PasswordPusher
1t 1c
high advisory

CVE-2026-59802 - PasswordPusher Data URI Scheme Vulnerability Leading to Client-Side JavaScript Execution

PasswordPusher versions prior to 2.8.1 contain a client-side vulnerability (CVE-2026-59802) due to insufficient validation of URL push payloads, allowing attackers to embed malicious data URI schemes that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

PasswordPusher vulnerability web-application client-side javascript credential-theft phishing
3t 1c