CVE-2026-108162 in Pingvin Share X
Summary
by MITRE • 10/10/2026
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
Pingvin Share versions prior to 1.22.0 are affected by a critical rate limit bypass vulnerability stemming from improper validation of proxy headers within the application backend. The core technical flaw resides in the file src/main.ts, where the server configuration unconditionally trusts incoming X-Forwarded-For header values without verifying their authenticity or source reliability. In standard web architectures behind reverse proxies like Nginx or HAProxy, these headers are used to identify the original client IP address for logging and security controls such as rate limiting. However, because Pingvin Share does not restrict which proxy IPs are trusted nor validate that the request actually originated from a known internal load balancer, any external attacker can manipulate this header directly in their HTTP requests. This architectural oversight effectively neutralizes per-IP throttling mechanisms designed to prevent brute-force attacks and automated abuse.
The operational impact of this vulnerability is severe for authentication endpoints including /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword. Since the backend relies on the spoofed X-Forwarded-For header to determine the client's identity for rate limiting purposes, an attacker can rotate through a large pool of fake IP addresses with each request. This technique allows them to bypass per-IP throttling limits entirely, enabling high-volume brute-force attacks against user passwords and Time-based One-Time Password (TOTP) codes without triggering account lockouts or temporary bans. Furthermore, this manipulation facilitates the forging of logged client IP addresses in server logs, which complicates forensic analysis and incident response efforts by obscuring the true origin of malicious activity.
From a classification perspective, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials if considered as part of broader authentication failures, but more accurately maps to CWE-306: Missing Authentication for Critical Function in the context of bypassing rate limits which serve as an access control mechanism. It also corresponds to MITRE ATT&CK technique T1110: Brute Force, specifically subtechnique T1110.004: Password Spraying or T1110.003: Offline Password Guessing when considering the ability to test multiple credentials rapidly without detection. The lack of proper proxy header validation is a common misconfiguration in modern web applications that rely on reverse proxies, highlighting the necessity for strict allow-lists of trusted proxy IPs and rigorous input sanitization practices.
To mitigate this vulnerability, administrators must upgrade Pingvin Share to version 1.22.0 or later where these trust issues have been addressed. For environments running older versions until an upgrade is feasible, it is imperative to configure the reverse proxy in front of Pingvin Share to strip or overwrite X-Forwarded-For headers from external clients, ensuring that only internal proxies can set this header. Additionally implementing Web Application Firewall rules that detect and block requests with suspiciously rotated IP patterns in these specific authentication endpoints can provide a compensating control. Security teams should also enforce multi-factor authentication requirements where possible to reduce the efficacy of brute-force attempts even if rate limits are bypassed, and monitor logs for anomalies indicative of header manipulation or rapid successive login failures from disparate sources.