PasswordPusher versions prior to 2.9.2 allow an attacker who has a valid push token to perform unthrottled brute‑force attempts of the associated passphrase at 120 attempts per minute.out on the POST /p/:token/access endpoint. Because the service currently accepts all guesses without alert, attackers can recover short or dictionary‑derived passphrases within hours or days, gaining unauthorized access to protected secrets. The weakness corresponds to CWE‑307, Improper Restriction of Excessive Authentication Attempts.

The affected product is PasswordPusher from developer pglombardo. All releases before 2.9.2 lack the required lockout or rate limiting for the passphrase‑verification endpoint. Users deploying these versions are therefore vulnerable.

The CVSS score of 8.7 classifies this issue as high severity. Although the EPSS score is reported as <1%, indicating low to very low exploitation probability, the flaw remains highly exploitable for anyone with a token because there are no defense mechanisms. The vulnerability is not listed in the CISA KEV catalog. Attackers must know the token, but once in possession, the endpoint’s unthrottled nature permits for targeted or opportunistic attacks.