CVE-2026-87816— PasswordPusher before 2.11.1 Race Condition View Limit Bypass
Quick assessment
Affected
pglombardo PasswordPusher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PasswordPusher 2.11.1 之前的版本中存在一个“检查时”到“使用时”（TOCTOU）的竞态条件，出现在视图限制（view limit enforcement）逻辑中，这使得未认证的攻击者能够绕过 限制。攻击者可以向 端点发送并发请求，从而在视图计数被递增、推送内容过期之前，多次访问一次性密钥（one-time secrets）。
Possible ATT&CK Techniques 1 AI
T1053 · Scheduled Task/Job
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87816
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PasswordPusher before 2.11.1 Race Condition View Limit Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pglombardo | PasswordPusher | 0 ~ 2.11.1 | - |
|
II. Public POCs for CVE-2026-87816
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87816
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87816 (2)
IV. Related Vulnerabilities
Same product: PasswordPusher
-
CVE-2026-62382
PasswordPusher before v2.9.6 Authentication Bypass via Null -
CVE-2026-61458
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottle -
CVE-2026-59802
PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in -
CVE-2026-41308
Password Pusher: JSON API `/p.json` file upload alias bypass -
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to
Same vendor: pglombardo
-
CVE-2026-62382
PasswordPusher before v2.9.6 Authentication Bypass via Null -
CVE-2026-61458
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottle -
CVE-2026-41308
Password Pusher: JSON API `/p.json` file upload alias bypass -
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to -
CVE-2024-52796
Password Pusher's rate limiter can be bypassed by forging pr
V. Comments for CVE-2026-87816
No comments yet