CVE-2026-61458 | PasswordPusher before 2.9.2 contains a brute-force vulnerabi… | CVSS 7.5 HIGH

Description

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.

Metadata

CVE ID: CVE-2026-61458
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-09 14:07 UTC
Published: 2026-07-13 21:30 UTC
Last updated: 2026-07-13 21:30 UTC
Primary CWE: CWE-307
Improper Restriction of Excessive Authentication Attempts
Vendor / Product: pglombardo / PasswordPusher
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
pglombardo	PasswordPusher	—	0 < 2.9.2, 2.9.2

Weakness (CWE)

CWE	Source	Description
CWE-307	cna	Improper Restriction of Excessive Authentication Attempts

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)

GitHub Security Advisory (GHSA-59w3-h5v2-c4xw) https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw
VulnCheck Advisory: PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint https://www.vulncheck.com/advisories/passwordpusher-passphrase-brute-force-via-unthrottled-endpoint