Vulnerability Description
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-
- https://www.vulncheck.com/advisories/passwordpusher-passphrase-brute-force-via-u
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-
FAQ
What is CVE-2026-61458?
CVE-2026-61458 is a vulnerability with a CVSS score of 7.5 (HIGH). PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a pus...
How severe is CVE-2026-61458?
CVE-2026-61458 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61458?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.