CVE-2026-108162
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.
Risk Assessment
The risk is the potential for brute-force attacks on authentication and IP address spoofing, which could lead to account takeover and hinder security audits.
Recommendation
It is recommended to update Pingvin Share X to version 1.22.0 or later and configure trust for proxy headers only from trusted sources.
Other vulnerabilities in Pingvin Share X
See all- CVE-2026-44196Critical
In Pingvin Share X versions 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker with a valid username and password to completely skip the two-factor authentication (TOTP) requirement. This vulnerability is fixed in version 1.16.3.
- CVE-2026-108163Medium
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.
- CVE-2026-108157High
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability allowing remote unauthenticated attackers to take over accounts. Attackers register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
- CVE-2026-49467High
Pingvin Share X versions 1.5.0 through 1.18.0 contain a vulnerability that allows an attacker to bypass password verification when managing TOTP settings. The root cause is a missing `await` keyword on calls to asynchronous methods `verifyPassword` and `authenticateUser`. In JavaScript, an unawaited Promise is always truthy, so the logic intended to throw a ForbiddenException when a password is incorrect never executes. The vulnerability is fixed in version 1.18.1.
Original NVD description (English source)
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS