CVE-2026-44196

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability allowing remote unauthenticated attackers to take over accounts. Attackers register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.

Pingvin Share X versions 1.5.0 through 1.18.0 contain a vulnerability that allows an attacker to bypass password verification when managing TOTP settings. The root cause is a missing `await` keyword on calls to asynchronous methods `verifyPassword` and `authenticateUser`. In JavaScript, an unawaited Promise is always truthy, so the logic intended to throw a ForbiddenException when a password is incorrect never executes. The vulnerability is fixed in version 1.18.1.