Pingvin Share X vulnerabilities

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability allowing remote unauthenticated attackers to take over accounts. Attackers register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.

In Pingvin Share X versions 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker with a valid username and password to completely skip the two-factor authentication (TOTP) requirement. This vulnerability is fixed in version 1.16.3.

Pingvin Share X versions 1.5.0 through 1.18.0 contain a vulnerability that allows an attacker to bypass password verification when managing TOTP settings. The root cause is a missing `await` keyword on calls to asynchronous methods `verifyPassword` and `authenticateUser`. In JavaScript, an unawaited Promise is always truthy, so the logic intended to throw a ForbiddenException when a password is incorrect never executes. The vulnerability is fixed in version 1.18.1.