CVE-2026-108162 smp46 CVE debrief

Who should care

Defenders responsible for systems using Pingvin Share X versions before 1.22.0 should assess exposure and potential impact, and prioritize verifying and upgrading to mitigate potential risks.

Why it matters

CVE-2026-108162 is a rate limit bypass vulnerability in Pingvin Share X before 1.22.0 that allows unauthenticated remote attackers to evade per-IP throttling by spoofing X-Forwarded-For headers, potentially leading to brute-force password attacks and TOTP code bypass. Defenders should prioritize verifying exposure and assessing potential impact, especially for systems using Pingvin Share X versions before 1.22.0.

• Potential brute-force password attacks
• Possible TOTP code bypass via spoofed X-Forwarded-For headers
• Need for verification of Pingvin Share X version and exposure
• Potential impact on authentication security

Technical summary

The Pingvin Share X application before version 1.22.0 contains a rate limit bypass vulnerability. This vulnerability allows unauthenticated remote attackers to evade per-IP throttling by spoofing X-Forwarded-For headers, potentially leading to brute-force password attacks and TOTP code bypass. The vulnerability is caused by the unconditional trust of proxy headers in backend/src/main.ts. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses. Defenders should prioritize verifying exposure and assessing potential impact, especially for systems using Pingvin ShareX

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially for systems using Pingvin Share X versions before 1.22.0.

Recommended defensive actions

• Verify Pingvin Share X version and upgrade to 1.22.0 or later if necessary
• Assess exposure and potential impact on systems using Pingvin Share X versions before 1.22.0
• Implement additional security measures to detect and prevent potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the rate limit bypass vulnerability in Pingvin Share X before 1.22.0. The vulnerability allows unauthenticated remote attackers to evade per-IP throttling by spoofing X-Forwarded-For headers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.