CyberRota Analysis
AI-GeneratedPasswordPusher versions prior to 2.11.1 are vulnerable to a time-of-check-to-time-of-use race condition that allows unauthenticated attackers to bypass the expire_after_views limit, enabling them to access one-time secrets multiple times. This flaw poses a significant risk as it undermines the intended security of secret sharing by allowing repeated access before the view count is updated. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.