Pingvin Share X CVE-2026-108157

Exploitation requires that the Pingvin Share X instance (version 0.19.0 up to but not including 1.22.0) has an OAuth/OIDC provider enabled and routed through GenericOidcProvider, and that automatic OAuth email linking in OAuthService.signUp() is active. The attacker must be able to create an account bearing the victim's exact email address on a trusted OIDC/OAuth provider WITHOUT that provider enforcing email verification - the flaw is the missing email_verified claim check, so providers that assert verified emails do not enable the attack. The attacker must also know the victim's email address. These factors (dependence on a specific provider configuration that permits unverified-email registration, plus the enabled auto-linking feature) are the AC:H/AT:P limiting conditions and should be weighed when prioritizing; instances not using OIDC, or using a provider that enforces email verification, are not exploitable.

This is a genuine high-priority issue rather than a CVSS-inflated one, but with important real-world caveats. The provided CVSS 4.0 vector (AV:N, PR:N, UI:N, VC:H/VI:H/VA:H) correctly reflects remote, unauthenticated, full-compromise potential - successful exploitation yields complete account takeover including administrator accounts and bypasses TOTP, so confidentiality, integrity and availability of the application are all fully impacted. However, the same vector flags AC:H and AT:P (attack complexity high, attack requirements present), which materially tempers the risk: exploitation is not a trivial one-shot and depends on specific preconditions (see exploitation_conditions). No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input. Per precision rules, this is therefore 'no public exploit identified at time of analysis' - exploitation is plausible and the root cause is clearly documented in the vendor advisory and patch commit, but there is no evidence of active exploitation or weaponized code. The absence of EPSS/KEV data is a gap, not a contradiction; it simply means spread/likelihood cannot be quantified from the available signals. Net: patch urgently if you run Pingvin Share X with OAuth/OIDC enabled, but the AC:H/AT:P requirements make mass, indiscriminate exploitation less likely than the 9.2 base score alone would suggest.

An attacker learns the email address of a Pingvin Share X user (e.g., an administrator) and registers that same email - left unverified - on an OAuth/OIDC identity provider that the target instance trusts. When the attacker signs in via that provider, OAuthService.signUp() automatically links the OAuth identity to the existing local account because GenericOidcProvider never checks the email_verified claim, logging the attacker in as the victim and bypassing TOTP. No public exploit code is identified at time of analysis, and the attack requires both a trusting OIDC provider and the automatic email-linking behavior (AC:H/AT:P).