TOTP authentication bypass in Pingvin Share X (CVE-2026-44196)

Pingvin Share X contains a critical authentication bypass vulnerability in its two-factor authentication flow. An attacker who has obtained a valid username and password can skip the TOTP second-factor requirement entirely, gaining full account access including the ability to manage shares, view sensitive files, and modify account settings. Affected versions: - 1.14.1-1.16.2 We recommend updating to: 1.16.3. CVSS 9.1 · our assessment: act_now Reference: https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq Details: https://vuln.today/cve/CVE-2026-44196