What is the CVSS score of CVE-2026-44196?

CVE-2026-44196 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pingvin Share X are affected by CVE-2026-44196?

Pingvin Share X versions 1.14.1 through 1.16.2 contain a critical two-factor authentication bypass vulnerability (CVSS 9.1) that allows attackers to completely circumvent TOTP verification and gain…. A patch is available.

How to fix or mitigate CVE-2026-44196?

Within 24 hours, identify all Pingvin Share X deployments running versions 1.14.1 through 1.16.2 and prepare upgrade procedures. Within 7 days, upgrade all affected instances to version 1.16.3 or later and verify successful deployment; review authentication logs for any suspicious account access or bypassed 2FA attempts during the vulnerable window. Within 30 days, conduct a comprehensive account security audit for instances that were vulnerable, including password resets for high-privilege accounts, review of access logs for indicators of exploitation, and implementation of additional monitoring for 2FA bypass attempts.

Pingvin Share X CVE-2026-44196

EUVD-2026-29727 CRITICAL

Improper Authentication (CWE-287)

2026-05-12 security-advisories@github.com

Authentication Bypass

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Attacker must already hold valid credentials, so PR:L not PR:N; remote low-complexity bypass yields high confidentiality/integrity impact over the victim account, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:07 vuln.today

Patch available

May 12, 2026 - 19:18 EUVD

CVE Published

May 12, 2026 - 18:17 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.

AnalysisAI

Two-factor authentication bypass in Pingvin Share X (self-hosted file sharing) versions 1.14.1 through 1.16.2 lets an attacker who already possesses a victim's valid username and password skip the TOTP second-factor challenge entirely, defeating the primary purpose of 2FA and granting full account access. CVSS is rated 9.1 (High/Critical), but EPSS is only 0.04% (13th percentile) and there is no public exploit identified at time of analysis, and it is not on CISA KEV. The fix landed in 1.16.3.

Technical ContextAI

Pingvin Share X is a self-hosted, open-source file-sharing platform (a Firefox Send-style alternative) that supports optional TOTP-based two-factor authentication for user accounts. The flaw is classified as CWE-287 (Improper Authentication): the login flow fails to enforce the second-factor step server-side after the password stage, so a client can proceed to an authenticated session without ever satisfying the TOTP challenge. In effect, 2FA is treated as a step that can be bypassed rather than a mandatory gate, collapsing the intended two-factor guarantee back to single-factor (password) security. The GitHub Security Advisory GHSA-j679-vp39-qwqq (also tracked as ENISA EUVD-2026-29727) documents the issue.

RemediationAI

Upgrade to Pingvin Share X 1.16.3 or later, which contains the vendor fix (Patch available per vendor advisory; exact fixed release confirmed as 1.16.3). Consult the advisory at https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq for details. Until patched, because the bypass only benefits an attacker who already holds valid credentials, the most effective compensating controls target credential exposure: force a password reset for accounts and require rotation of any shared/reused passwords, restrict the login/admin interface to a VPN or trusted IP allowlist (trade-off: breaks access for legitimate remote users), and enable rate-limiting or monitoring/alerting on successful logins from unusual locations to detect misuse of stolen credentials. Do not rely on TOTP as a mitigation on affected versions, since the flaw is precisely that the TOTP check can be skipped.