CVE-2026-59802: PasswordPusher Data URI Injection – Credential Theft Risk

Technical summary

The vulnerability stems from insufficient URL validation in PasswordPusher's valid_url function. The application fails to properly reject data URI schemes (data:text/html), which allow arbitrary HTML and JavaScript to be embedded directly in URLs. When a user clicks a push containing a data URI payload, the browser executes the embedded script within the origin of the PasswordPusher application. This occurs because the validation logic does not maintain a strict allowlist of safe URI schemes (http, https) or implement proper origin-checking for external redirects. The flaw is classified as CWE-183 (Permissive Allowlist), indicating the function accepts data URIs that should be blocked outright.

Business impact

Organizations relying on PasswordPusher for secure credential distribution face significant risk. Attackers can intercept or social-engineer users into clicking malicious pushes that harvest credentials, MFA tokens, or session cookies. Because the attack executes under PasswordPusher's domain, victims may have high trust in the link and less scrutiny toward subsequent prompts. This undermines the security promise of the application and could erode confidence in credential-sharing workflows. Widespread exploitation could damage reputation and create liability if credential theft affects downstream systems or customer data.

Affected systems

PasswordPusher versions prior to 2.8.1 are vulnerable. The issue affects all deployments—whether self-hosted or cloud-based—that have not been updated to 2.8.1 or later. No other products are directly implicated by this CVE. Organizations should audit their PasswordPusher deployment version immediately and prioritize updating affected instances.

Exploitability

The vulnerability has a low barrier to exploitation. An attacker needs only to craft a PasswordPusher push URL that contains a data URI payload pointing to malicious JavaScript. No authentication or special privileges are required to create a push. The attack succeeds if the victim clicks the link—a realistic social engineering scenario. The CVSS score of 8.2 (HIGH) reflects the network-accessible, user-interaction-dependent nature and the potential for high confidentiality impact (credential theft). The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation suggests it could be weaponized quickly.

Remediation

Upgrade PasswordPusher to version 2.8.1 or later, which implements proper URL scheme validation. Before upgrading, review recent push history for suspicious data URI patterns that may indicate prior exploitation. Organizations should also reinforce user awareness that PasswordPusher links should only redirect to expected destinations and that unexpected prompts for credentials warrant verification outside the PasswordPusher context.

Patch guidance

Apply PasswordPusher 2.8.1 or later to all affected instances as soon as feasible. For self-hosted deployments, refer to the official PasswordPusher repository and release notes to confirm the patched version and any migration steps. Cloud-hosted instances should verify with the provider that the environment is running 2.8.1 or later. Test the patched version in a non-production environment first to ensure compatibility with existing configurations. After deployment, confirm via application logs or administrative interface that the new version is active.

Detection guidance

Search application logs and traffic captures for push URLs containing data: URI schemes or suspicious base64-encoded content in push payloads. Monitor for push creation patterns from unexpected sources or with unusual payload structures. Examine browser history and security logs for users who accessed PasswordPusher links, looking for unexpected JavaScript execution or credential-entry prompts following a push click. Implement network segmentation and content-security policies that restrict script execution unless explicitly trusted. Consider alerting on any push containing URI schemes other than http or https.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines the security of a tool designed to protect credentials. The low complexity of exploitation, combined with high confidentiality impact and the user-interaction dependency that makes social engineering feasible, classifies it as HIGH risk. Although not yet in CISA's KEV catalog, the straightforward nature of the attack and the trusted context of PasswordPusher make it an attractive target for opportunistic threat actors. Organizations should patch within one business week.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: Network-accessible attack vector (AV:N); low attack complexity requiring only a crafted URL (AC:L); no authentication needed to create a malicious push (PR:N); user interaction required to click the link (UI:R); scope change to other contexts due to execution under PasswordPusher's domain (S:C); high confidentiality impact from credential theft (C:H); and low integrity impact (I:L). Availability is not impacted (A:N) because the service remains functional. The score appropriately captures the serious but not critical nature of the flaw.

Frequently asked questions