CVE-2026-108163 in Pingvin Share X
Summary
by MITRE • 10/10/2026
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
Pingvin Share versions prior to 1.22.0 contain a critical authentication security flaw stemming from an ineffective rate limiting mechanism within the application's throttling logic. The core technical deficiency arises from a unit conversion error where time-to-live values for request throttlers, which are intended to be specified in seconds, are incorrectly interpreted as milliseconds by the underlying implementation. This discrepancy results in throttle windows that expire nearly instantaneously rather than persisting for the configured duration, effectively disabling the protective barrier against rapid successive requests. Consequently, the application fails to enforce meaningful delays between authentication attempts, leaving critical endpoints exposed to high-volume automated attacks without triggering standard abuse prevention protocols.
The operational impact of this vulnerability is severe, as it allows unauthenticated attackers to bypass security controls designed to mitigate brute-force and credential stuffing attacks. Specifically, the affected endpoints including /api/auth/signIn for password-based login, /api/auth/signIn/totp for two-factor authentication code verification, and /api/auth/resetPassword for account recovery are all susceptible to rapid-fire requests. An attacker can exploit this flaw to attempt thousands of password combinations or TOTP codes per second, significantly increasing the probability of successfully guessing valid credentials or bypassing multi-factor authentication protections. This lack of effective rate limiting undermines the integrity of user accounts and sensitive data stored within the Pingvin Share instance, potentially leading to unauthorized access, data exfiltration, or complete compromise of shared files and directories.
From a classification perspective, this vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, which describes scenarios where an application does not adequately limit the number of login attempts allowed within a given timeframe. Furthermore, in terms of adversary tactics, this flaw facilitates techniques associated with MITRE ATT&CK ID T1110 Brute Force and specifically T1110.003 Password Spraying when combined with multiple usernames, or T1621 Multi-Factor Authentication Interception if the attacker is attempting to bypass MFA via code guessing. The absence of proper throttling allows these techniques to be executed at scale without detection by standard security monitoring tools that rely on request frequency anomalies as indicators of compromise.
To mitigate this vulnerability, administrators must upgrade Pingvin Share to version 1.22.0 or later where the rate limiting logic has been corrected to properly interpret time units in seconds. Until an upgrade is feasible, implementing a web application firewall with strict rate-limiting rules for authentication endpoints can provide external protection by artificially enforcing request delays and blocking IPs that exceed reasonable thresholds. Additionally, organizations should ensure that strong password policies are enforced to reduce the effectiveness of brute-force attempts even if rate limiting fails temporarily. Monitoring logs for unusual spikes in failed login attempts or TOTP verification failures is also recommended as a defensive measure to detect ongoing exploitation activities against these endpoints.