← Back

CVE-2026-41308

nvd nist
Published: May 8, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Exploitability: 3.9 / Impact: 2.5
Source: security-advisories@github.com (Secondary)

Description

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

Affected (2)

Apnotic
1 product
Password Pusher
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Apnotic
Password Pusher
Before 1.69.3
Password Pusher
From 2.0.0 to 2.4.2

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.