Authentication Bypass in Pingvin Share X File Sharing Platform
CVE-2026-49467

8.8HIGH

Key Information:

Vendor

Smp46

Status
Pingvin-share-x
Vendor
CVE Published:
12 August 2026

What is CVE-2026-49467?

Pingvin Share X, a self-hosted file sharing platform, has a vulnerability that permits attackers to bypass password verification when managing Time-based One-Time Password (TOTP) settings. This issue arises from a missing 'await' keyword in calls to the asynchronous 'verifyPassword' method, which causes the application to misinterpret password verifications. The intended security checks fail since the resulting Promise is always truthy, allowing unauthorized access to the TOTP settings. The flaw exists in versions 1.5.0 through 1.18.0 and is addressed in version 1.18.1, ensuring proper awaiting of asynchronous authentication calls. Users facing lockout situations must rely on administrators to manually reset TOTP status in the database, as there are no official workarounds.

Affected Version(s)

pingvin-share-x >= 1.5.0, < 1.18.1

References

https://github.com/smp46/pingvin-share-x/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.