Security Fix, Nine OSS Releases & Keycloak SSO

A new High-severity security advisory, nine OSS releases including dark mode and a payload privacy toggle, Keycloak IDP support for Self-Hosted Pro Enterprise, and a new blog post on credential sharing for AI agents. Let's get to it.

OSS Password Pusher

👮 Security Advisory

A new security advisory has been published to the GitHub Security Advisories page.

If you're self-hosting OSS Password Pusher, please update to at least v2.11.5.

• GHSA-6q3c-57pp-wvpp (High) — A race condition in view-limit enforcement. If you asynchronously pummel a 1-view push, you could extract more than one view — defeating the one-time-secret guarantee. Fixed in v2.11.2.

This brings the total to five published security advisories in 2026. Thank you to @tonghuaroot for responsibly disclosing this issue.

As always, pwpush.com was patched immediately. If you're running a self-hosted instance, v2.11.5 covers everything.

🐣 Releases: v2.9.8 through v2.11.5

Nine releases since the last newsletter. Beyond the security fix above:

• v2.9.9 — Administration Center is out of BETA.

• v2.10.0 — Light/dark theme toggle. Users can switch between light and dark mode from the UI. Self-hosted admins can lock the theme instance-wide with PWP__THEME_MODE. Documentation (Requested by @jstilwell in #861)

• v2.11.0 — Eye toggle to hide the payload while typing — useful for shared screens and shoulder-surfing scenarios. App version now shown in the admin sidebar. (Eye toggle requested by @popescuvitor in #2658; admin version requested by @ecoutinho in #2693)

• v2.11.1 — Fix for custom brand logos falling back to stock dark logo; theme toggle on the background jobs page. (Logo bug reported by @SemoTech in #4752)

• v2.11.3 — Docker-style _FILE support for encryption secrets: load PWPUSH__MASTER_KEY and SECRET_KEY_BASE from files instead of environment variables directly. Also fixes 1Password autofill on login after Turbo navigation. (File-based secrets requested by @Viajaz in #848)

• v2.11.4 — Fix for Devise validation errors after Turbo auth form submissions.

• v2.11.5 — API pagination metadata headers on list endpoints. (Requested by @liquid-metal in #1661)

As always, dependency and security updates ship with every release cycle. The latest is v2.11.5.

Self-Hosted Pro

🔑 New: Keycloak IDP Support

Self-Hosted Pro Enterprise v1.3.0 adds Keycloak as a supported identity provider. Keycloak is an open-source identity and access management platform widely used in enterprise and government environments, and it was one of the more frequently requested additions to the SSO suite.

This joins the existing IDP options on Self-Hosted Pro Enterprise: Google Workspace, Microsoft Entra ID, Okta, Auth0, NetScaler, and Custom OAuth2. Configuration is self-serve via Admin → Settings → Auth, and SSO-only login remains enforceable.

Available now for Self-Hosted Pro Enterprise subscribers.

📰 New on the Blog

• Credential Sharing for AI Agents — AI agents need credentials to call APIs and access services. The dominant approach is persistent vault access with scoped runtime fetch. But many workflows are better served by ephemeral credential handoff: a self-destructing link the agent reads once, with a full audit trail and no persistent secret in the delivery channel.

Thank You

Thank you to @tonghuaroot for responsibly disclosing the view-limit race condition, and to @jstilwell, @popescuvitor, @Viajaz, @liquid-metal, @ecoutinho, and @SemoTech for the feature requests and bug reports that drove this round of releases. Responsible disclosure and community feedback keep Password Pusher moving forward — if you find something, the GitHub Security Advisories page is the place to report it, and GitHub Issues for everything else.

Thanks for making it to the end!

Password Pusher will never have paid placements, growth hacks, or engagement tricks. No investor pressure. No ad-driven metrics. Organic growth has brought us this far — I'd rather build something people genuinely want to use than something that tricks people into using it.

Peter Giacomo Lombardo & the Apnotic Team