Search
Find a vulnerability
Search criteria
4 vulnerabilities by WardPearce
CVE-2026-68512 (GCVE-0-2026-68512)
Vulnerability from nvd – Published: 2026-11-11 21:57 – Updated: 2026-11-11 21:57
VLAI
EPSS
VEX
Title
Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing
Summary
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.
Severity
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WardPearce/paaster/security/ad… | x_refsource_CONFIRM |
| https://github.com/WardPearce/paaster/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WardPearce | paaster |
Affected:
< 3.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "paaster",
"vendor": "WardPearce",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster\u0027s account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account\u0027s password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T21:57:31.618Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg"
},
{
"name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-9q9w-qhhm-2xwg",
"discovery": "UNKNOWN"
},
"title": "Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68512",
"datePublished": "2026-11-11T21:57:31.618Z",
"dateReserved": "2026-07-30T16:19:08.082Z",
"dateUpdated": "2026-11-11T21:57:31.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68511 (GCVE-0-2026-68511)
Vulnerability from nvd – Published: 2026-11-11 21:56 – Updated: 2026-11-11 21:56
VLAI
EPSS
VEX
Title
Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes
Summary
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
Severity
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WardPearce/paaster/security/ad… | x_refsource_CONFIRM |
| https://github.com/WardPearce/paaster/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WardPearce | paaster |
Affected:
< 3.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "paaster",
"vendor": "WardPearce",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster\u0027s \"view once\" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that\u0027s supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as \"not yet read\" and all successfully retrieve it. This issue has been patched in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T21:56:59.654Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v"
},
{
"name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-xh42-5mjw-2f4v",
"discovery": "UNKNOWN"
},
"title": "Paaster: TOCTOU race condition defeats the \u0027burn after reading\u0027 guarantee on view-once pastes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68511",
"datePublished": "2026-11-11T21:56:59.654Z",
"dateReserved": "2026-07-30T16:19:08.082Z",
"dateUpdated": "2026-11-11T21:56:59.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68512 (GCVE-0-2026-68512)
Vulnerability from cvelistv5 – Published: 2026-11-11 21:57 – Updated: 2026-11-11 21:57
VLAI
EPSS
VEX
Title
Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing
Summary
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.
Severity
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WardPearce/paaster/security/ad… | x_refsource_CONFIRM |
| https://github.com/WardPearce/paaster/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WardPearce | paaster |
Affected:
< 3.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "paaster",
"vendor": "WardPearce",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster\u0027s account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account\u0027s password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T21:57:31.618Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg"
},
{
"name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-9q9w-qhhm-2xwg",
"discovery": "UNKNOWN"
},
"title": "Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68512",
"datePublished": "2026-11-11T21:57:31.618Z",
"dateReserved": "2026-07-30T16:19:08.082Z",
"dateUpdated": "2026-11-11T21:57:31.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68511 (GCVE-0-2026-68511)
Vulnerability from cvelistv5 – Published: 2026-11-11 21:56 – Updated: 2026-11-11 21:56
VLAI
EPSS
VEX
Title
Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes
Summary
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
Severity
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WardPearce/paaster/security/ad… | x_refsource_CONFIRM |
| https://github.com/WardPearce/paaster/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WardPearce | paaster |
Affected:
< 3.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "paaster",
"vendor": "WardPearce",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster\u0027s \"view once\" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that\u0027s supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as \"not yet read\" and all successfully retrieve it. This issue has been patched in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T21:56:59.654Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v"
},
{
"name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0"
}
],
"source": {
"advisory": "GHSA-xh42-5mjw-2f4v",
"discovery": "UNKNOWN"
},
"title": "Paaster: TOCTOU race condition defeats the \u0027burn after reading\u0027 guarantee on view-once pastes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68511",
"datePublished": "2026-11-11T21:56:59.654Z",
"dateReserved": "2026-07-30T16:19:08.082Z",
"dateUpdated": "2026-11-11T21:56:59.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}