Critical Authentication Flaw in Pingvin Share X Could Allow Account Takeover (CVE-2026-108157)

A critical security vulnerability in Pingvin Share X could allow remote attackers to take over user accounts, including administrator accounts, by exploiting weaknesses in the application’s OAuth authentication process.

Tracked as CVE-2026-108157, the vulnerability was published on 9 October 2026 and has been assigned a CVSS 4.0 score of 9.2 out of 10, placing it in the critical severity category. The flaw affects versions of Pingvin Share X from 0.19.0 up to, but not including, version 1.22.0.

Pingvin Share X is an open-source file-sharing application. The vulnerability centres on how the software handles email addresses when users sign in through an external identity provider using OAuth or OpenID Connect (OIDC).

How the vulnerability works

According to the published vulnerability details, the issue arises because the application’s authentication process does not properly verify whether an email address supplied by an external identity provider has been confirmed as belonging to the user.

The flaw involves the application’s OAuthService.signUp() function and its GenericOidcProvider implementation. A missing check of the email_verified claim can allow an attacker to exploit automatic account linking.

Under the conditions described in the advisory, an unauthenticated attacker could register a victim’s unverified email address with an enabled OAuth or OIDC provider and use the authentication weakness to gain access to the victim’s account.

The potential consequences are particularly serious because the attack could extend to administrator accounts. The published details also state that the attack could bypass time-based one-time password (TOTP) authentication, weakening an additional layer of account protection.

Potential security impact

Successful exploitation could give an attacker unauthorised access to information and functionality available through a compromised account. Depending on the privileges associated with that account, this could expose sensitive files, allow information to be modified or deleted, and affect the security of the wider file-sharing service.

Administrator account compromise would present an especially significant risk, potentially giving an attacker control over important application settings and other users’ data.

Although the vulnerability is remotely exploitable without an existing account, its CVSS 4.0 assessment identifies high attack complexity and the presence of attack requirements. This means exploitation is not necessarily straightforward in every deployment, and the relevant authentication configuration and conditions must be considered.

Affected versions and recommended action

Pingvin Share X versions from 0.19.0 to versions earlier than 1.22.0 are listed as affected.

Administrators should prioritise checking their installed version and upgrading to version 1.22.0 or later, where available. They should also review the project’s official release notes and security advisories for details of the correction and any additional migration steps.

Organisations using OAuth or OIDC sign-in should review their identity-provider configuration and ensure that email addresses are verified before they are trusted for account creation or account linking. They should also examine authentication logs for unusual sign-ins, unexpected account-linking activity and suspicious administrator access.

Where compromise is suspected, administrators should investigate affected accounts, revoke active sessions and credentials where appropriate, and reset authentication factors if necessary.

A reminder about authentication security

CVE-2026-108157 highlights the risks of relying on external identity providers without adequately validating the information they supply. Email-based account linking must be handled carefully, particularly where administrator accounts and sensitive files are involved.

Organisations running Pingvin Share X should establish whether they are using an affected version and take appropriate steps to secure their installations.

Source: OffSeq Threat Radar — CVE-2026-108157. The source lists the affected versions and critical severity, but says patch status is not yet confirmed. Administrators should verify the fix in the project’s official release notes before treating an upgrade as a confirmed remediation.