CVE-2026-61458 PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
Attackers can brute-force PasswordPusher passphrases via an unthrottled endpoint, potentially recovering secrets if tokens are known.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61458?
CVE-2026-61458 is a high-severity vulnerability in pglombardo PasswordPusher, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Weakness: CWE-307
Which versions are affected by CVE-2026-61458?
How do I fix CVE-2026-61458?
No fix has been published for CVE-2026-61458 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61458 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61458 exists.
Sources
Also known as GHSA-59w3-h5v2-c4xw, GHSA-w4jg-w96x-q3wh.