CVE-2026-68511
Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
| CWE | CWE-362 |
| Vendor | wardpearce |
| Product | paaster |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for wardpearce paaster
Be the first to know when new unknown vulnerabilities affecting wardpearce paaster are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
WardPearce / paaster
< 3.3.0