Pingvin Share X before version 1.22.0 contains a rate limit bypass flaw that allows an unauthenticated attacker to evade per‑IP throttling. The vulnerability exists because the server code unconditionally trusts proxy headers such as X‑Forwarded‑For. By rotating spoofed values for this header, an attacker can send many authentication requests to endpoints like /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword without hitting the intended limits. This flaw is classified as CWE‑348 – Incomplete Input Validation. The primary impact is the ability to brute‑force passwords and two‑factor codes, potentially compromising user accounts and forging client IP addresses in logs. No other direct impact such as code execution or data exfiltration is disclosed.

The vulnerability affects all deployments of Pingvin Share X versions earlier than 1.22.0. No specific sub‑versions are enumerated, so any instance running 1.21.x or older is considered affected.

The CVSS score of 6.9 indicates moderate severity. EPSS data is unavailable, so exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via HTTP requests to the authentication endpoints that include a spoofed X‑Forwarded‑For header. Because the flaw allows bypassing per‑IP throttling, skilled attackers can perform thousands of authentication attempts in a short period, increasing the likelihood of a successful credential or TOTP compromise.