CVE-2026-87816

    Dashboard / Vulnerabilities / CVE-2026-87816

    CVE-2026-87816

    Published: 9 Sept 2026Last Modified: 12 Sept 2026

    Summary: PasswordPusher before 2.11.1 Race Condition View Limit Bypass

    Details: PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87816.json, https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp, https://nvd.nist.gov/vuln/detail/CVE-2026-87816, https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limit-bypass

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a33d9448f106ab470c8317fcfc478950cc58f774

    Affected versions

    v2.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-87816 | CVE-DB