Pingvin Share X EUVD-2026-96317

Exploitable against default deployments: backend/src/main.ts calls app.set('trust proxy', true) unconditionally in versions before 1.22.0, so the server trusts any client-supplied X-Forwarded-For header with no special configuration needed. The only prerequisites are network reachability of the auth endpoints (/api/auth/signIn, /api/auth/signIn/totp, /api/auth/resetPassword) and the attacker's ability to set arbitrary HTTP headers. Limiting factors: the bug only removes throttling, so actual account compromise still depends on guessable passwords or low-entropy/weak-lockout TOTP, and a correctly configured upstream proxy that strips or overwrites X-Forwarded-For would blunt the spoofing; the fix additionally requires operators to set TRUST_PROXY=true only when a trusted proxy is genuinely in front.

This is a genuine but moderate-severity issue, not a critical drop-everything flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which is why the base score lands at 6.9 (medium). Crucially, the impact metrics are only VC:L/VI:L/VA:N - the bug itself does not directly compromise data; it defeats a per-IP anti-brute-force control, so its real damage is conditional on downstream brute-forcing of weak passwords or TOTP codes. No EPSS score is provided in the input, so exploitation probability cannot be quantified. KEV status is not present (no CISA listing), and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent (network vector matches an HTTP-header-based attack against public endpoints); the main missing data are EPSS and any independent exploitation evidence. Net: a credible, easy-to-trigger weakness that materially raises brute-force risk, but its ceiling is limited by the low technical impact and dependence on weak target credentials.

An attacker points a brute-force tool at an internet-exposed Pingvin Share X instance and hammers /api/auth/signIn and /api/auth/signIn/totp, rotating a fresh spoofed X-Forwarded-For value on every request so the per-IP rate limiter never trips. Because backend/src/main.ts sets 'trust proxy' to true unconditionally, the app treats each forged header as the real client IP, enabling unlimited password/TOTP guessing and poisoning of logged source IPs. No public exploit code is referenced, but the technique is trivial to script with any HTTP client.