CVE-2026-61458— PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pglombardo | PasswordPusher | < 2.9.2 | affected |
2.9.2 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-61458
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
Source: NVD (National Vulnerability Database)
Vulnerability Description
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
过多认证尝试的限制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
pglombardo PasswordPusher 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pglombardo PasswordPusher是pglombardo的密码推送工具。 pglombardo PasswordPusher 2.9.2之前版本存在授权问题漏洞，该漏洞源于POST /p/:token/access端点缺少路由特定的速率限制和每次推送锁定机制，可能导致知道推送令牌的攻击者系统性地猜测口令，每小时最多120次尝试，而不会触发任何推送级别的防御，使得短口令或基于字典的口令在数小时或数天内可被实际恢复。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pglombardo | PasswordPusher | 0 ~ 2.9.2 | - |
II. Public POCs for CVE-2026-61458
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61458
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-61458 (2)
IV. Related Vulnerabilities
Same product: PasswordPusher
- CVE-2026-59802
PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in - CVE-2026-41308
Password Pusher: JSON API `/p.json` file upload alias bypass - CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to - CVE-2024-52796
Password Pusher's rate limiter can be bypassed by forging pr - CVE-2024-51989
Cross-site Scripting (XSS) Vulnerability in PasswordPusher
Same vendor: pglombardo
Same weakness: CWE-307
- CVE-2026-42952
Hydro-Québec Le Circuit Electrique charging station backend - CVE-2026-15079
Login Disable - Moderately critical - Access bypass - SA-CON - CVE-2026-55501
9router: Login brute-force protection bypass via spoofed X-F - CVE-2026-53904
Account Denial of Service in MCO - CVE-2026-35098
Improper Restriction of Excessive Authentication Attempts in
V. Comments for CVE-2026-61458
No comments yet