smp46 Pingvin Share X up to 1.21.x Proxy Header backend/src/main.ts X-Forwarded-For authentication bypass

Summaryinfo

A vulnerability identified as critical has been detected in smp46 Pingvin Share X up to 1.21.x. Impacted is an unknown function of the file backend/src/main.ts of the component Proxy Header Handler. The manipulation of the argument X-Forwarded-For leads to authentication bypass. This vulnerability is documented as CVE-2026-108162. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in smp46 Pingvin Share X up to 1.21.x and classified as critical. This issue affects some unknown functionality of the file backend/src/main.ts of the component Proxy Header Handler. The manipulation of the argument X-Forwarded-For with an unknown input leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-108162 since 10/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.22.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-96317). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• smp46

Name

• Pingvin Share X

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion