CVE-2026-61458 describes a brute-force vulnerability in PasswordPusher before version 2.9.2. The POST /p/:token/access endpoint does not implement route-specific rate limiting or per-push lockout mechanisms, enabling attackers with knowledge of a push token to perform up to 120 passphrase attempts per minute without triggering defenses. This flaw significantly reduces the time required to recover short or dictionary-derived passphrases, exposing sensitive data protected by PasswordPusher.

An attacker who knows a valid push token can systematically guess passphrases at a high rate without triggering any push-level defense mechanisms. This can lead to unauthorized access to protected data if the passphrase is short or derived from a dictionary, compromising confidentiality. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's announcements for updates. Until a fix is available, consider implementing external rate limiting or access controls to mitigate brute-force attempts on the affected endpoint.