Pingvin Share X CVE-2026-108163

No special configuration is required - the broken throttler ships enabled but ineffective in default deployments of Pingvin Share X before 1.22.0, so any network-reachable instance is exposed to unauthenticated, unthrottled requests against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword. The practical LIMITING factor is that this flaw only removes rate limiting; it does not bypass authentication, so success still requires guessing a valid password or a 6-digit TOTP code within its validity window, meaning strong/unique passwords and the short TOTP lifetime materially reduce real-world impact. Exposure also depends on the instance being internet-facing.

This is a moderate-severity authentication-hardening failure, not a direct code-execution or data-leak flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reach with no user interaction, and the impact is bounded to low confidentiality and low integrity (VC:L/VI:L, VA:N, no scope change), yielding a score of 6.9. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass scanning - this reads as a priority driven by the ease of the primitive rather than by observed in-the-wild abuse. The real risk is conditional: the bug does not grant access by itself, it removes the throttling that normally makes online brute-forcing of /api/auth/signIn, the TOTP endpoint, and password-reset infeasible, so impact depends entirely on downstream credential/TOTP guessability. The source-code evidence strongly corroborates the root cause (ttl values of 60 and 5*60 changed to multiply by 1000), so the mechanism is confirmed even though exploitation prevalence is unknown. Note the 'Information Disclosure' input tag does not match the actual weakness class (CWE-307, improper restriction of excessive authentication attempts) - treat that tag with suspicion.

An attacker locates an internet-exposed Pingvin Share X instance (before 1.22.0) and scripts rapid repeated POSTs against /api/auth/signIn, /api/auth/signIn/totp, or /api/auth/resetPassword. Because the throttler interprets its intended per-minute/per-5-minute windows as milliseconds, requests sail through effectively unthrottled, letting the attacker brute-force a target's password or 6-digit TOTP code until they gain account access. No public exploit code is identified in the provided data, but the one-line root cause and endpoints are documented in the patch commit, making a working script trivial to produce.