A critical authentication bypass flaw allows an attacker who knows a valid username and password to skip the required TOTP second‑factor authentication. The vulnerability requires the attacker to already possess valid user credentials, which can be obtained through credential compromise or social engineering. Once bypassed, the attacker can access the file sharing platform with full privileges, compromising confidential data and integrity of stored files.

Pingvin Share X self‑hosted file sharing platform, versions 1.14.1 through 1.16.2, provided by smp46.

The CVSS score of 9.1 indicates a high‑severity flaw. Although no EPSS score is available, the absence of a KEV listing does not diminish the seriousness of the issue. Exploitation requires valid credentials, making the attack vector credential‑dependent but feasible for attackers who have already stolen or guessed passwords. Given the severity and the potential for unfettered access, the risk remains substantial.