CVE-2026-61458 describes a brute-force vulnerability in PasswordPusher before version 2.9.2. The affected endpoint, POST /p/:token/access, does not implement rate limiting or lockout mechanisms specific to each push token. Consequently, an attacker with knowledge of a valid push token can perform rapid passphrase guessing at a rate of 120 attempts per minute without triggering any push-level defense. This flaw significantly reduces the effort required to recover short or dictionary-derived passphrases, exposing sensitive data shared via PasswordPusher to compromise.

An attacker who knows a valid push token can perform high-rate brute-force attacks against the passphrase protecting that push. Because there are no rate limits or lockouts, short or weak passphrases can be recovered within hours or days, potentially exposing confidential information shared via PasswordPusher. This compromises the confidentiality of the pushed secrets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider using longer, complex passphrases to reduce the risk of brute-force recovery. Monitor vendor channels for updates regarding patches or official mitigations.