Key points
- The flaw affects Pingvin Share X versions 0.19.0 through 1.22.0.
- Attackers can bypass Two-Factor Authentication (TOTP) to access victim accounts.
- The issue stems from missing email verification checks in the OAuth service.
A severe security vulnerability in Pingvin Share X allows remote attackers to take over user accounts, including those of system administrators, without needing valid login credentials. The flaw, tracked as CVE-2026-108157, carries a CVSS score of 9.2, classifying it as critical. By abusing the application’s automatic email linking feature during OAuth sign-ups, attackers can effectively impersonate legitimate users and gain full access to their data and permissions.
In plain English
The vulnerability exists in how Pingvin Share X handles new user registrations via OAuth or OpenID Connect (OIDC) providers. When a user attempts to sign up or link an account, the system is supposed to verify that the person registering actually owns the email address they provide. However, the software fails to check if the email has been verified by the external provider.
An attacker can exploit this by registering a victim’s unverified email address on an enabled OAuth provider. Because the application does not confirm that the email belongs to the person initiating the registration, it accepts the link. This allows the attacker to sign in as the victim. Crucially, this method bypasses additional security layers, such as Time-based One-Time Passwords (TOTP), meaning even users with two-factor authentication enabled are not protected against this specific attack vector.
The background
The issue is classified under CWE-287, which denotes improper authentication. According to the National Vulnerability Database (NVD) record, the flaw is located within the `OAuthService.signUp()` function. Specifically, the `GenericOidcProvider` component lacks a necessary check for the `email_verified` claim. This missing validation step allows the application to trust email associations that have not been properly confirmed by the identity provider, creating a pathway for unauthorized account takeover.
What changes now
The vulnerability affects all versions of Pingvin Share X from 0.19.0 up to, but not including, version 1.22.0. The vendor, smp46, has released version 1.22.0, which addresses this improper authentication vulnerability. Users running any affected version are advised to upgrade immediately to mitigate the risk of unauthorized access. Until the update is applied, administrators should be aware that their accounts, and those of their users, are susceptible to takeover via this OAuth exploitation method.
What to do and how to stay safe: Pingvin Share X
- Update Pingvin Share X to version 1.22.0 or later as soon as possible to apply the vendor's fix.
- Review OAuth and OIDC provider configurations to ensure strict email verification requirements are enforced.
- Monitor system logs for unusual login attempts or new account creations that may indicate exploitation.
- Enforce strong password policies and consider additional monitoring for administrative account activities.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Pingvin Share X are affected by CVE-2026-108157?
Versions 0.19.0 through 1.22.0 are affected. Version 1.22.0 contains the fix.
Can attackers bypass two-factor authentication with this flaw?
Yes, the vulnerability allows attackers to bypass TOTP by taking over the account via unverified email linking.
What is the CVSS score for this vulnerability?
The CVSS score is 9.2, which is rated as critical severity.
