Pingvin Share X versions prior to 1.22.0 contain an ineffective rate‑limiting flaw caused by an incorrect conversion of throttler TTL values from seconds to milliseconds. This misconfiguration allows attackers to submit authentication requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword at an effectively unlimited rate, enabling brute‑force attacks against user passwords and TOTP codes while remaining unauthenticated. The weakness corresponds to CWE‑307 and could lead to unauthorized access to user accounts or data.

All deployments of the Pingvin Share X application owned by smp46 running any version earlier than 1.22.0 are vulnerable. Specific release tags before v1.22.0 have not applied the TTL correction described in later commits.

The CVSS score of 6.9 indicates a medium severity attack that can be carried out without prior compromise. EPSS data is unavailable, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a burst of unauthenticated API requests to the authentication endpoints, leveraging the incorrect millisecond TTL to bypass application‑level throttling. The impact is a potential account takeover or denial of service to authentication services.