CVE-2026-61458: falha de alta gravidade em pglombardo PasswordPusher
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pglombardo · PasswordPusherCVEs relacionadas — pglombardo PasswordPusher
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62382MEDIUMPasswordPusher before v2.9.6 Authentication Bypass via Null ComparisonEPSS 1.2%CVE-2024-52796MEDIUMPassword Pusher's rate limiter can be bypassed by forging proxy headersEPSS 0.5%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2026-41308MEDIUMPassword Pusher: JSON API `/p.json` file upload alias bypasses file-push authenticationEPSS 0.3%CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%