CVE-2026-87816: PasswordPusher before 2.11.1 Race Condition View Limit Bypass
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can make requests to the affected PasswordPusher show endpoint can attempt exploitation. No credentials or user interaction are required.
What conditions are needed to bypass a secret's view limit?
The attacker must send concurrent requests to the show endpoint while the secret is still available. The race occurs before the view count is incremented and the push expires.
Are one-time secrets affected?
Yes. Concurrent requests can allow a secret configured for a single view, or another expire_after_views limit, to be accessed multiple times before expiration.
What version resolves the issue?
PasswordPusher 2.11.1 resolves this issue. Versions before 2.11.1 are affected.