CVE-2026-108163
Received Received - Intake

Pingvin Share X Rate Limiting Bypass Vulnerability

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-108163
EUVD
EUVD-2026-96318

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smp46 pingvin-share-x 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Pingvin Share X before version 1.22.0 has a rate limiting flaw where throttler TTL values specified in seconds are incorrectly interpreted as milliseconds. This allows unauthenticated attackers to bypass rate limits and send unthrottled requests to authentication endpoints like /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword.

Detection Guidance

Check if your Pingvin Share X instance is running a version before 1.22.0. Inspect network traffic for repeated failed login attempts to /api/auth/signIn, /api/auth/signIn/totp, or /api/auth/resetPassword endpoints. Monitor server logs for unusually high request rates to these paths.

Impact Analysis

Attackers can exploit this to brute-force passwords and TOTP codes without rate limits, potentially gaining unauthorized access to user accounts. This increases the risk of account takeover and data breaches.

Mitigation Strategies

Upgrade Pingvin Share X to version 1.22.0 or later. If upgrading is not immediately possible, implement additional rate limiting at the network or application level for the affected endpoints. Block or restrict access to /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart