CVE-2026-61458

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.9.2

Description An issue exists where passphrase-protected pushes are susceptible to brute-force attacks. The 'POST /p/:token/access' endpoint lacks route-specific rate limiting and per-push lockout mechanisms. This allows an attacker who possesses a push token to systematically guess passphrases at a rate of 120 attempts per minute, potentially recovering short or dictionary-derived passphrases within hours or days.

Recommendations Update to version 2.9.2 or later.