CVE-2026-49467 in Pingvin Share X
Summary
by MITRE • 08/12/2026
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The Pingvin Share X platform presents a critical authorization bypass vulnerability affecting versions 1.5.0 through 1.18.0 that fundamentally compromises the security of time-based one-time password implementations. This vulnerability specifically targets the authentication flow for TOTP management settings, creating a scenario where unauthorized individuals can bypass password verification mechanisms entirely. The flaw exists within the core authentication service implementation where asynchronous method calls are improperly handled, creating a dangerous condition in the application's security logic.
The technical root cause stems from a fundamental programming error in two key service files: `authTotp.service.ts` and `auth.service.ts`. In both locations, developers omitted the `await` keyword when invoking asynchronous methods that should return boolean validation results. The `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts` are designed to return Promise objects containing boolean values indicating authentication success or failure. However, without proper awaiting, these asynchronous operations return immediately with Promise objects rather than their resolved boolean outcomes.
This fundamental error creates a logical flaw that directly violates security best practices and can be classified under CWE-1037, which addresses improper handling of asynchronous operations in security-critical contexts. The JavaScript runtime behavior where unawaited Promises are always truthy means that the conditional logic designed to reject invalid authentication attempts never executes properly. Instead of evaluating the actual password validation result, the system evaluates whether a Promise object exists, which is inherently true regardless of password correctness.
The operational impact of this vulnerability extends beyond simple unauthorized access to TOTP management functions. An attacker who discovers this weakness can gain complete control over user authentication settings without proper credentials, potentially leading to account takeover scenarios and complete bypass of multi-factor authentication protections. This represents a critical failure in the principle of least privilege and undermines the entire security model of the platform's authentication system. The vulnerability directly maps to ATT&CK technique T1078.004, which covers legitimate accounts used for unauthorized access, as attackers can leverage this flaw to impersonate users without proper authorization.
The fix implemented in version 1.18.1 addresses the core issue by ensuring all asynchronous authentication calls are properly awaited throughout the authentication service stack. This remediation restores the intended logical flow where boolean results from password verification methods determine authentication success or failure, rather than allowing Promise object references to control program execution. The absence of official workarounds indicates that administrators must perform manual database interventions when users become locked out, highlighting the severity and persistence of this security flaw. This vulnerability demonstrates how seemingly minor coding oversights can create catastrophic security implications in authentication systems, emphasizing the critical importance of proper asynchronous operation handling in security-sensitive applications and reinforcing the need for comprehensive code review processes that specifically validate authentication flow integrity across all application layers.