PasswordPusher versions prior to 2.11.1 contain a time‑of‑check to time‑of‑use race condition in the enforcement of the view limit that controls how many times a one‑time secret can be retrieved. An unauthenticated attacker can send multiple concurrent requests to the show endpoint, causing the system to return the secret more than once before the view counter is incremented and the secret is marked expired. This flaw directly undermines the confidentiality guarantees of the application, allowing repeated access to data that should be destroyed after a single view.

The vulnerability affects the PasswordPusher application released by pglombardo. All installations running any version older than 2.11.1 are susceptible; version 2.11.1 and later contain the fix.

The CVSS score of 8.7 classifies this as a high severity flaw. While no EPSS score is available, the lack of a KEV listing does not indicate low risk; the vector requires only unauthenticated network access to the show endpoint and can be triggered by sending concurrent requests. The simplicity of the required payload and the immediate confidentiality impact mean that the risk remains significant if the affected application is exposed to the internet.