Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 HIGH: CVE-2026-61458 (CVSS 7.5) PasswordPusher <2.9.2 vulnerable to brute-force attacks on passphrase-protected pushes. Attackers can attempt 120 guesses/min with no lockout. Patch immediately to v2.9.2+ #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/ZMnSSijsyX
Post summary
CVE-2026-61458 exposes a brute‑force weakness in PasswordPusher versions below 2.9.2; users are urged to upgrade to 2.9.2+ to mitigate the risk.