Description
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.
Published: 2026-08-12
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Pingvin Share X versions 1.5.0 through 1.18.0 contain a flaw that allows an attacker to bypass password verification when editing Time‑based One‑Time Password (TOTP) settings. The bug arises from missing "await" statements on asynchronous authentication calls, causing the promised result to be treated as a truthy object rather than the resolved boolean. Consequently, the logic intended to reject invalid passwords never executes, permitting an attacker to enable or alter TOTP for a user without providing the correct password. This vulnerability is an authentication bypass (CWE‑303) and a missing critical authority verification (CWE‑304), and if exploited can give an attacker unauthorized control over a user’s two‑factor configuration, potentially facilitating elevated access to files or other privileged actions.

Affected Systems

The affected product is the Pingvin Share X file sharing platform by smp46. All releases from 1.5.0 up to and including 1.18.0 are impacted; the fix is delivered in version 1.18.1 and subsequent releases.

Risk and Exploitability

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw through the web interface by accessing the TOTP management functions; successful exploitation would allow configuration of a user’s TOTP without password confirmation, thereby elevating privileges or maintaining persistence.

Generated by OpenCVE AI on August 12, 2026 at 23:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Pingvin Share X to version 1.18.1 or later, which properly awaits all asynchronous authentication calls.
  • If an immediate upgrade is not possible, block or restrict the TOTP management endpoint at the network or reverse‑proxy level so that only trusted administrative sessions can reach it.
  • For users who are locked out and cannot reset their password, manually clear or reset the user’s TOTP status in the database as a temporary remedy, noting that this does not prevent the bypass for other accounts.

Generated by OpenCVE AI on August 12, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Smp46
Smp46 pingvin-share-x
Vendors & Products Smp46
Smp46 pingvin-share-x

Wed, 12 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.
Title TOTP enrollment hijack: password gate skipped due to unawaited promise
Weaknesses CWE-303
CWE-304
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Smp46 Pingvin-share-x
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-14T21:52:13.060Z

Reserved: 2026-05-30T04:17:43.094Z

Link: CVE-2026-49467

cve-icon Vulnrichment

Updated: 2026-08-14T21:52:08.956Z

cve-icon NVD

Status : Received

Published: 2026-08-12T18:17:30.637

Modified: 2026-08-14T22:16:34.523

Link: CVE-2026-49467

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T00:00:09Z

Weaknesses
  • CWE-303

    Incorrect Implementation of Authentication Algorithm

  • CWE-304

    Missing Critical Step in Authentication