CVE-2026-108162
Received Received - Intake

Pingvin Share X Rate Limit Bypass via Proxy Header Spoofing

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-108162
EUVD
EUVD-2026-96317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smp46 pingvin-share-x 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108162 is a rate limit bypass vulnerability in Pingvin Share X versions before 1.22.0. It allows unauthenticated remote attackers to evade per-IP throttling by spoofing the X-Forwarded-For header, which the application unconditionally trusts. Attackers can rotate spoofed values to brute-force passwords and TOTP codes or forge logged client IP addresses.

Detection Guidance

Check if your Pingvin Share X instance is running a vulnerable version (before 1.22.0) by inspecting the version in use. Monitor authentication endpoints like /api/auth/signIn for repeated failed login attempts from varying IP addresses, which may indicate brute-force attacks exploiting this vulnerability.

Impact Analysis

This vulnerability enables attackers to bypass authentication protections, potentially gaining unauthorized access to accounts by brute-forcing passwords or TOTP codes. It also allows forgery of logged client IP addresses, complicating forensic analysis and audit trails.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines authentication safeguards, potentially resulting in non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade Pingvin Share X to version 1.22.0 or later immediately. If upgrading is not possible, configure your reverse proxy to strip X-Forwarded-For headers before they reach the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart