CVE-2026-87816

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use (TOCTOU) race condition (CWE-362) in its enforcement of expire_after_views limits on shared pushes. An unauthenticated attacker who has access to a push URL can send multiple concurrent requests to the show endpoint, retrieving the secret several times before the view counter is incremented and the push expires. This defeats the "view once" (or view N times) guarantee, so one-time secrets can be read more times than intended, which the CVSS 4.0 score of 8.7 (high) rates as a high-confidentiality impact with no privileges or user interaction required. Anyone running an affected self-hosted PasswordPusher instance, or using the project's public hosted service, to share secrets with view-based expiration is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; the issue was assigned by the VulnCheck CNA.

What to do: Upgrade PasswordPusher to 2.11.1 or later to remediate the race condition. Until patched, treat view-limited pushes as not strictly one-time, prefer time-based expiration (expire_after_days) for highly sensitive secrets, and monitor the show endpoint for bursts of concurrent requests against the same push URL. Operators of internet-facing instances should prioritize updating, and users of the hosted service should watch for provider updates.