Executive brief
PasswordPusher, a tool used to securely share sensitive information like passwords, contains a flaw that allows attackers to guess passphrases through brute-force attacks. Because the system does not limit the number of failed attempts for specific shared links, an attacker who has the link can systematically test thousands of common passwords. If successful, the attacker can gain full access to the secret data intended for another recipient.
Technical details
A brute-force vulnerability exists in PasswordPusher's passphrase verification logic within the 'POST /p/:token/access' endpoint. The application lacks route-specific rate limiting and does not implement a per-push failed attempt counter or lockout mechanism. While a global IP-based throttle of 120 requests per minute exists via Rack::Attack, it is insufficient to prevent the recovery of short or dictionary-based passphrases. An attacker with a valid push token can automate passphrase guesses to bypass protection and access the secret payload. The issue is addressed in version 2.9.2 by implementing specific throttling and lockout logic.
Affected products
- pglombardo PasswordPusher < 2.9.2
Timeline
- 2026-07-06: advisory: GitHub Security Advisory published by vendor
- 2026-07-13: disclosed: CVE published and NVD record created
- 2026-07-13: patched: Vendor released version 2.9.2 to address the issue