CVE-2026-41308
6.5 MEDIUMPassword Pusher is an open source application to communicate sensitive information over the web
Published: 2026-05-08 · Last updated: 2026-06-05
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- CWE
- CWE-288
Affected products
| Vendor | Product |
|---|---|
| apnotic | password_pusher |
Description
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-41308
- [Patch]https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4
- [Patch]https://github.com/pglombardo/PasswordPusher/pull/4381
- [Vendor advisory]https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c
Related CVEs
Same CWE
- CVE-2026-12225 — syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability
- CVE-2026-49764 — Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions (9.8 CRITICAL)
- CVE-2026-48970 — Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions (8.1 HIGH)
- CVE-2026-42668 — Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions (7.5 HIGH)
- CVE-2026-42411 — Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions (8.1 HIGH)