# CVE-2026-41308: PasswordPusher authentication bypass in JSON API file creation

Source: https://junglewise.ai/threats/cve-2026-41308-passwordpusher-authentication-bypass-in-json-api-file-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-41308 · Severity: medium · CVSS 6.5 · Published 2026-05-08

PasswordPusher is an open-source application used to securely share sensitive information and files via temporary links. A security flaw allowed unauthenticated users to upload files through the application's API, even when the system was configured to require login for such actions. While this does not directly expose existing private data, it could allow unauthorized individuals to consume server storage and bandwidth, potentially leading to increased costs or service instability.

Technologies: [Peter Lombardo PasswordPusher](https://junglewise.ai/threats/technologies/passwordpusher). Vendors: [Peter Lombardo](https://junglewise.ai/threats/vendors/peter-lombardo).

## Quick answers

**Is CVE-2026-41308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41308 being exploited in the wild.

**How severe is CVE-2026-41308?** Medium severity, with a CVSS score of 6.5, published 8 May 2026.

**Which products and versions are affected?** Peter Lombardo PasswordPusher < 1.69.4, 2.0.0 - 2.4.1.

**Is there a fix for CVE-2026-41308?** A patch was published on 2026-04-14: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41308 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41308?** Check whether you run Peter Lombardo PasswordPusher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability (CWE-288) exists in PasswordPusher's API endpoints. Specifically, the `Api::V1::PushesController#create` path failed to consistently enforce authentication for file-type pushes when certain anonymous creation settings were enabled. An unauthenticated remote attacker could exploit this by sending a specially crafted JSON API request to create a file push, bypassing intended access controls. This allows for unauthorized file uploads, leading to potential storage exhaustion and bandwidth consumption. The issue has been resolved by implementing stricter authentication checks in the API controller and adding regression tests.

## Affected products

- pglombardo PasswordPusher < 1.69.4, 2.0.0 - 2.4.1

## Timeline

- 2026-04-14: patched: Fix committed to master branch
- 2026-04-17: advisory: Vendor security advisory published
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4](https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4)
- [https://github.com/pglombardo/PasswordPusher/pull/4381](https://github.com/pglombardo/PasswordPusher/pull/4381)
- [https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c](https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c)