Read the docs
TI-2026-44522 Aliases CVE-2026-62382GHSA-h7j9-p76m-fhvx

PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

Priority HIGH 70CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01169 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed PasswordPusher (pglombardo): 2.9.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pglombardoPasswordPusherbefore 2.9.62.9.6Patch availableCNA
  • PasswordPusher Vendorpglombardo Affected before 2.9.6 Fixed in 2.9.6 Patch available CNA

Remediation

  • Fix · CNA PasswordPusher (pglombardo) Fixed in 2.9.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62382
  2. 2026-10-03 Alias added: GHSA-h7j9-p76m-fhvx

References

Exploit 1

Advisory 1

  • TI-2026-59933 PasswordPusher before 2.11.1 Race Condition View Limit Bypass CVSS 4.0HIGH 8.7
  • TI-2026-44063 PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint CVSS 4.0HIGH 8.7
  • TI-2024-35309 Password Pusher's rate limiter can be bypassed by forging proxy headers CVSS 3.1MEDIUM 5.3
  • TI-2024-34877 Cross-site Scripting (XSS) Vulnerability in PasswordPusher CVSS 3.1HIGH 7.1
  • TI-2024-37617 Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences