CVE-2026-49467
Received Received - Intake

Authentication Bypass in Pingvin Share X via Unawaited Promises

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-49467
EUVD
EUVD-2026-57356

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
smp46 pingvin_share_x From 1.5.0 (inc) to 1.18.0 (inc)
smp46 pingvin_share_x 1.18.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pingvin Share X (versions 1.5.0 to 1.18.0) allows attackers to bypass password verification when managing Time-based One-Time Password (TOTP) settings due to missing await keywords on asynchronous authentication method calls. This causes unawaited Promises to always evaluate as truthy, bypassing intended password checks.

Detection Guidance

Check if your Pingvin Share X instance is running a vulnerable version (1.5.0 to 1.18.0) by inspecting the version in the application or logs. Look for unawaited Promise calls in authTotp.service.ts and auth.service.ts files. Verify if TOTP settings can be modified without correct password validation.

Impact Analysis

An attacker could hijack accounts by enabling TOTP with any password using a stolen access token. This may lead to permanent account lockout for victims. LDAP-authenticated users are also affected. The impact includes high confidentiality, integrity, and availability risks.

Mitigation Strategies

Immediately update Pingvin Share X to version 1.18.1 or later to patch the vulnerability. If users are locked out due to TOTP manipulation, an administrator must manually reset the user's TOTP status in the database by setting totpEnabled, totpVerified to false, and totpSecret to null.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart