# CVE-2026-87816: PasswordPusher race condition in view limit enforcement

Source: https://junglewise.ai/threats/cve-2026-87816-passwordpusher-race-condition-in-view-limit-enforcement  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87816 · Severity: high · CVSS 7.5 · Published 2026-09-09

PasswordPusher is a web application for securely sharing passwords and sensitive data with automatic expiration after a specified number of views. A race condition in the view limit enforcement allows attackers to bypass the one-time secret guarantee by sending concurrent requests, enabling multiple views of a secret that should expire after a single access. This defeats the core security mechanism users rely on when sharing sensitive information.

## Quick answers

**Is CVE-2026-87816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87816 being exploited in the wild.

**How severe is CVE-2026-87816?** High severity, with a CVSS score of 7.5, published 9 September 2026.

**Which products and versions are affected?** PasswordPusher PasswordPusher before 2.11.1.

**Is there a fix for CVE-2026-87816?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87816 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87816?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PasswordPusher contains a time-of-check-to-time-of-use (TOCTOU) race condition in view limit enforcement (CWE-362). The vulnerable code in pushes_controller.rb checks view limits and delivers the payload before logging the view as an audit entry, with no database locking or transaction wrapping. An unauthenticated attacker can send multiple concurrent GET requests to the /p/{url_token} endpoint; all requests will read the same (zero) view count, pass the limit check, and return the secret payload before any audit log is created. The vulnerability is reachable remotely without authentication and affects both the web and JSON API endpoints. Patched in version 2.11.1 and later.

## Affected products

- PasswordPusher PasswordPusher before 2.11.1

## Timeline

- 2026-08-25: disclosed: GitHub Security Advisory GHSA-6q3c-57pp-wvpp published
- 2026-09-09: advisory: CVE-2026-87816 assigned and published in NVD

## References

- [https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp](https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp)
- [https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limit-bypass](https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limit-bypass)