Pingvin Share X versions between 0.19.0 and before 1.22.0 have an authentication flaw that allows a remote attacker to take over user accounts, including administrators. The bug arises from an unchecked email_verified flag in the OAuthService.signUp() flow, meaning an account can be created or authenticated with any email address that is not verified. The result is that the attacker can gain full control of the victim’s account without needing the victim’s password or multifactor credentials. This results in a loss of confidentiality, integrity, and availability for all users who rely on the platform’s account security.

The affected product is Pingvin Share X from smp46. Vulnerable releases include 0.19.0 and any version up through, but not including, 1.22.0. Any deployment that has OAuth/OIDC provider integration enabled is susceptible to the exploitation, regardless of how many providers are configured.

The CVSS score of 9.2 indicates critical severity. The EPSS score is not available, but the missing email verification check is a straightforward vulnerability that can be targeted with a simple registration of an attacker‑controlled email on an enabled OAuth provider. Based on the description, it is inferred that the attacker only needs to register the victim’s email with a provider and then initiate an OAuth sign‑in to be accepted as the victim, bypassing any TOTP or other multi‑factor enforcement. The CVE is not listed in CISA’s KEV catalog, yet the potential to control administrative accounts makes it a high‑risk threat.