Pingvin Share X
Monthly
Account takeover in Pingvin Share X 0.19.0 through 1.21.x allows remote attackers to seize arbitrary accounts - including administrator accounts - by registering a victim's email address on an enabled OAuth/OIDC provider that does not enforce email verification, then signing in through the OAuth flow, which auto-links to the victim's existing account without any email_verified check and bypasses TOTP. Successful exploitation yields full read/write access to the victim's files and settings as well as any administrative privileges the victim holds. The attack is unauthenticated (CVSS:3.1 PR:N/UI:N) but is not universally exploitable: it requires that the instance has an OAuth/OIDC provider routed through GenericOidcProvider, that automatic OAuth email linking is active, and that the attacker knows the victim's email address and can register it unverified on that provider - the AC:H/AT:P conditions reflected in both the assessed CVSS:3.1 vector (8.1) and the vendor's CVSS:4.0 score of 9.2. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released fix is available in 1.22.0.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Pingvin Share X before 1.22.0 ships with an ineffective authentication rate limiter, because throttler TTL values written in seconds are interpreted by NestJS as milliseconds - collapsing intended 60-second and 5-minute windows into roughly 60 ms and 5 ms. This allows unauthenticated remote attackers to send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword, enabling brute-force attempts against user passwords and 6-digit TOTP codes; no public exploit code has been identified at time of analysis and there is no KEV entry, and the flaw is assessed as a moderate authentication-hardening failure rather than a direct code-execution or data-leak issue. Because the weakness only removes rate limiting, successful compromise still depends on guessing a valid password or a valid TOTP value within its short validity window, so strong unique passwords and the limited TOTP lifetime materially reduce real-world risk.
A rate-limiting bypass in Pingvin Share X before 1.22.0 lets unauthenticated remote attackers defeat per-IP throttling on the sign-in, TOTP, and password-reset endpoints by rotating spoofed X-Forwarded-For headers. Because backend/src/main.ts calls app.set('trust proxy', true) unconditionally, any client-supplied forwarding header is believed, so attackers can brute-force passwords or TOTP codes at unrestricted speed and poison IP-based logging with forged client addresses. Exploitation requires only network reachability of the auth API and the ability to send arbitrary headers - no special configuration - though real account compromise still depends on weak credentials or low-entropy codes. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-patched version 1.22.0 is available (CWE-348, CVSS 4.0 base 6.9 / assessed CVSS 3.1 6.5).
Account takeover in Pingvin Share X 0.19.0 through 1.21.x allows remote attackers to seize arbitrary accounts - including administrator accounts - by registering a victim's email address on an enabled OAuth/OIDC provider that does not enforce email verification, then signing in through the OAuth flow, which auto-links to the victim's existing account without any email_verified check and bypasses TOTP. Successful exploitation yields full read/write access to the victim's files and settings as well as any administrative privileges the victim holds. The attack is unauthenticated (CVSS:3.1 PR:N/UI:N) but is not universally exploitable: it requires that the instance has an OAuth/OIDC provider routed through GenericOidcProvider, that automatic OAuth email linking is active, and that the attacker knows the victim's email address and can register it unverified on that provider - the AC:H/AT:P conditions reflected in both the assessed CVSS:3.1 vector (8.1) and the vendor's CVSS:4.0 score of 9.2. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released fix is available in 1.22.0.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Pingvin Share X before 1.22.0 ships with an ineffective authentication rate limiter, because throttler TTL values written in seconds are interpreted by NestJS as milliseconds - collapsing intended 60-second and 5-minute windows into roughly 60 ms and 5 ms. This allows unauthenticated remote attackers to send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword, enabling brute-force attempts against user passwords and 6-digit TOTP codes; no public exploit code has been identified at time of analysis and there is no KEV entry, and the flaw is assessed as a moderate authentication-hardening failure rather than a direct code-execution or data-leak issue. Because the weakness only removes rate limiting, successful compromise still depends on guessing a valid password or a valid TOTP value within its short validity window, so strong unique passwords and the limited TOTP lifetime materially reduce real-world risk.
A rate-limiting bypass in Pingvin Share X before 1.22.0 lets unauthenticated remote attackers defeat per-IP throttling on the sign-in, TOTP, and password-reset endpoints by rotating spoofed X-Forwarded-For headers. Because backend/src/main.ts calls app.set('trust proxy', true) unconditionally, any client-supplied forwarding header is believed, so attackers can brute-force passwords or TOTP codes at unrestricted speed and poison IP-based logging with forged client addresses. Exploitation requires only network reachability of the auth API and the ability to send arbitrary headers - no special configuration - though real account compromise still depends on weak credentials or low-entropy codes. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-patched version 1.22.0 is available (CWE-348, CVSS 4.0 base 6.9 / assessed CVSS 3.1 6.5).