High severity7.5NVD Advisory· Published Sep 9, 2026· Updated Sep 9, 2026
CVE-2026-87816
CVE-2026-87816
Description
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<2.11.1+ 1 more
- (no CPE)range: <2.11.1
- (no CPE)range: <2.11.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.