Key points
- CVE-2026-108157 is rated Critical with a CVSS score of 9.2 according to the National Vulnerability Database.
- The flaw affects Pingvin Share X versions from 0.19.0 up to, but not including, version 1.22.0.
- Attackers can bypass Time-based One-Time Password (TOTP) protection and take over administrative accounts.
A critical security vulnerability in Pingvin Share X allows remote, unauthenticated attackers to take over user accounts, including those with administrative privileges, without needing valid credentials. The flaw, tracked as CVE-2026-108157, exploits improper authentication logic within the application’s OAuth integration, specifically bypassing two-factor authentication mechanisms.
How it unfolded
- The vulnerability exists in the OAuthService.signUp() function, which handles the automatic linking of email addresses during the OAuth or OpenID Connect (OIDC) registration process.
- According to the National Vulnerability Database, the code fails to verify the email_verified status when processing tokens from an OIDC provider via GenericOidcProvider.
- An attacker can register a victim’s unverified email address on an enabled OAuth provider and use that token to sign in as the victim, effectively hijacking the account.
Who is affected
The vulnerability impacts all installations of Pingvin Share X running versions 0.19.0 through any version prior to 1.22.0. The software is developed by vendor smp46. System administrators managing self-hosted instances of this file-sharing platform are at risk if they have configured OAuth or OIDC providers for user authentication.
Any account that relies on this OAuth flow for login is susceptible to takeover. The risk is particularly severe for administrative accounts, as gaining access to an admin user provides full control over the Pingvin Share X instance. The flaw allows attackers to bypass Time-based One-Time Password (TOTP) security measures entirely, rendering that specific layer of protection ineffective against this attack vector.
What happens next
No patch or fix has been confirmed yet for versions prior to 1.22.0 according to the provided source material. Administrators should verify their current installation version immediately. If the version is below 1.22.0, the instance is vulnerable to this specific exploitation method.
The National Vulnerability Database classifies the weakness under CWE-287, which denotes improper authentication. This classification highlights the fundamental failure in verifying the identity and status of the email address provided during the OAuth handshake. Until a secure version is deployed, the risk of unauthorized account access remains high for any exposed Pingvin Share X server.
Background: One-time passwords
One-time passwords work by generating a unique code from a shared secret and the current time. The server calculates the expected code and compares it to what you enter. This ensures that intercepted codes cannot be reused, adding a layer of protection beyond static credentials.
Read the full guide: How Do One Time Passwords Work: The Mechanics Behind Secure Access
What to do and how to stay safe: Pingvin Share X
- Review Pingvin Share X configuration settings to identify if OAuth or OIDC providers are currently enabled for user authentication.
- Monitor authentication logs for unusual sign-in attempts, particularly those originating from unfamiliar OAuth providers or showing successful logins with unverified email tokens.
- Enforce strict network segmentation to limit external access to the Pingvin Share X administration interface and ensure only trusted IPs can manage OAuth settings.
- Prepare to upgrade to version 1.22.0 or later once the vendor confirms the release addresses CVE-2026-108157, testing the update in a staging environment first.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108157?
The National Vulnerability Database rates CVE-2026-108157 as Critical with a CVSS score of 9.2.
Which versions of Pingvin Share X are vulnerable?
Versions from 0.19.0 up to, but not including, 1.22.0 are affected by this improper authentication vulnerability.
Does this flaw allow attackers to bypass two-factor authentication?
Yes, attackers can bypass Time-based One-Time Password (TOTP) protection by exploiting the missing email verification check in the OAuth flow.
