CRITICAL 9.2 NVD
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts b
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
References
- https://github.com/smp46/pingvin-share-x
- https://github.com/smp46/pingvin-share-x/blob/de7ffecf9bfc4976993149a5c4c98efe35161424/bac
- https://github.com/smp46/pingvin-share-x/commit/07aa8c0a96030c439e9018ce94a2778bd37304e6
- https://github.com/smp46/pingvin-share-x/releases/tag/v1.22.0
- https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-wrcg-4874-45p7
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-09 via NVD.
Risk Timeline
CVE Disclosed2026-10-09 · 2 days ago
Remediation Resources
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.