smp46 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH smp46 CVE published 2026-08-12

CVE-2026-49467

A vulnerability in Pingvin Share X versions 1.5.0 through 1.18.0 allows an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings due to a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. This issue arises because an unawaited `Promise` in JavaScript is [truncated]