Critical Pingvin Share X Flaw Allows Unauthenticated Admin Account Takeover

A critical security vulnerability discovered in Pingvin Share X allows remote, unauthenticated attackers to take over user accounts. The flaw, tracked as CVE-2026-108157, exists in the application’s OAuth service implementation and enables attackers to bypass standard authentication controls, including Time-based One-Time Password (TOTP) multi-factor authentication.

According to the National Vulnerability Database (NVD), the issue stems from improper authentication logic within the `OAuthService.signUp()` function. Specifically, the `GenericOidcProvider` component fails to verify that an email address has been confirmed by the OAuth or OpenID Connect (OIDC) provider. This missing `email_verified` check allows an attacker to register a victim’s unverified email address on an enabled OAuth provider. Once registered, the attacker can use this mechanism to sign in as the victim. This capability extends to administrative accounts, granting the attacker full control over the instance without needing valid credentials or passing secondary authentication steps.

Vulnerability Context and Mechanics

The vulnerability is classified under CWE-287, which relates to improper authentication. The NVD has assigned the flaw a CVSS score of 9.2, categorizing it as Critical severity. The attack vector is remote and requires no prior authentication, making it highly exploitable if the affected software is exposed to the internet.

The root cause lies in the automatic email linking process during OAuth sign-up. By exploiting the absence of a verification check, an attacker can associate any email address with their own OAuth identity. This allows them to trigger a sign-in event for the target email address. Because the system does not confirm that the email owner actually authorized the link, the attacker gains immediate access. This bypasses not only password requirements but also TOTP, rendering multi-factor authentication ineffective for this specific attack path.

Affected Software and Versions

The vulnerability impacts Pingvin Share X, a file-sharing application developed by smp46. The flaw is present in versions starting from 0.19.0 and continuing through all releases prior to version 1.22.0. Any deployment running a version within this range is susceptible to the described account takeover attack. Users on version 1.22.0 and later are not affected by this specific issue, as the fix has been included in that release.

What should you do?

Administrators running Pingvin Share X should immediately check their current version. If the installation is older than 1.22.0, upgrading to the latest version is the confirmed remediation. Until an upgrade is possible, organizations should monitor for unusual login activity, particularly from OAuth providers. Restricting access to the application via network-level controls can also reduce exposure.