Executive brief
PasswordPusher is a web application for securely sharing passwords and sensitive data with automatic expiration after a specified number of views. A race condition in the view limit enforcement allows attackers to bypass the one-time secret guarantee by sending concurrent requests, enabling multiple views of a secret that should expire after a single access. This defeats the core security mechanism users rely on when sharing sensitive information.
Technical details
PasswordPusher contains a time-of-check-to-time-of-use (TOCTOU) race condition in view limit enforcement (CWE-362). The vulnerable code in pushes_controller.rb checks view limits and delivers the payload before logging the view as an audit entry, with no database locking or transaction wrapping. An unauthenticated attacker can send multiple concurrent GET requests to the /p/{url_token} endpoint; all requests will read the same (zero) view count, pass the limit check, and return the secret payload before any audit log is created. The vulnerability is reachable remotely without authentication and affects both the web and JSON API endpoints. Patched in version 2.11.1 and later.
Affected products
- PasswordPusher PasswordPusher before 2.11.1
Timeline
- 2026-08-25: disclosed: GitHub Security Advisory GHSA-6q3c-57pp-wvpp published
- 2026-09-09: advisory: CVE-2026-87816 assigned and published in NVD