CVE-2026-44196: Pingvin Share X Auth Bypass Vulnerability

CVE-2026-44196 Overview

CVE-2026-44196 is an authentication bypass vulnerability in Pingvin Share X, a self-hosted file sharing platform. The flaw affects versions 1.14.1 through 1.16.2 and allows attackers with valid credentials to bypass the second-factor authentication (TOTP) requirement entirely. The vulnerability is classified under [CWE-287] Improper Authentication. While the attack requires prior knowledge of the victim's username and password, successful exploitation defeats the multi-factor authentication control intended to protect accounts against credential compromise. The maintainers addressed the issue in version 1.16.3.

Critical Impact
Attackers with valid credentials can bypass TOTP-based two-factor authentication and gain full account access on affected Pingvin Share X instances.

Affected Products

Pingvin Share X versions 1.14.1 through 1.16.2
Self-hosted file sharing deployments using TOTP second-factor authentication
All instances upgraded from earlier versions but not yet patched to 1.16.3

Discovery Timeline

2026-05-12 - CVE-2026-44196 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44196

Vulnerability Analysis

The vulnerability resides in the authentication flow of Pingvin Share X. When a user account has TOTP-based two-factor authentication enabled, the application is expected to require a valid time-based one-time password before granting an authenticated session. In affected versions 1.14.1 through 1.16.2, the second-factor check can be skipped after the first factor (username and password) succeeds. This collapses the security model from two factors to one. An attacker who has already obtained credentials through phishing, credential stuffing, or password reuse can authenticate without ever providing the TOTP code. The flaw maps to [CWE-287] Improper Authentication.

Root Cause

The root cause is incomplete enforcement of the multi-factor authentication state during the login sequence. The application validates the password but fails to require a verified TOTP submission before issuing session credentials. Refer to the GitHub Security Advisory GHSA-j679-vp39-qwqq for technical specifics published by the maintainer.

Attack Vector

The attack vector is network-based and requires no user interaction beyond standard login traffic. An attacker who already possesses valid credentials interacts with the authentication endpoint directly and skips the TOTP challenge step. The vulnerability impacts confidentiality and integrity but does not directly impact availability. Because exploitation requires prior credential compromise, the practical risk concentrates on organizations relying on TOTP as a compensating control for weak or reused passwords.

// No verified exploit code is publicly available.
// See the GitHub Security Advisory for technical details:
// https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq

Detection Methods for CVE-2026-44196

Indicators of Compromise

Successful authentication events for TOTP-enabled accounts without a corresponding TOTP verification log entry
Session creation immediately following a password validation event, skipping the expected second-factor step
Logins from unusual geographies or IP addresses on accounts that should require TOTP

Detection Strategies

Correlate authentication logs to confirm every TOTP-enabled account login includes a verified TOTP submission before session issuance
Alert on session tokens issued to MFA-enrolled users when no second-factor event precedes the session
Review reverse proxy and application access logs for direct calls to authentication endpoints that bypass the TOTP step

Monitoring Recommendations

Forward Pingvin Share X authentication logs to a centralized SIEM for correlation and retention
Monitor for anomalous login success rates against accounts protected by TOTP
Track administrative actions performed shortly after logins to flag potential post-bypass activity

How to Mitigate CVE-2026-44196

Immediate Actions Required

Upgrade all Pingvin Share X instances to version 1.16.3 or later without delay
Force password resets for all users, particularly those with elevated privileges
Invalidate active sessions to terminate any sessions established through the bypass
Audit recent authentication logs for evidence of TOTP-skipped logins

Patch Information

The vendor released a fix in Pingvin Share X version 1.16.3. Administrators should pull the patched release and follow the upgrade procedure documented in the GitHub Security Advisory. Verify the running version after upgrade to confirm remediation.

Workarounds

Restrict network access to the Pingvin Share X interface using IP allowlisting or a VPN until the upgrade is complete
Enforce strong, unique passwords across all accounts to reduce the value of credential-only compromise
Temporarily disable external exposure of the service if an immediate upgrade is not feasible

bash

# Upgrade example for a Docker-based deployment
docker pull stonith404/pingvin-share:1.16.3
docker compose down
docker compose up -d

# Verify the running version
docker exec <container_name> cat package.json | grep version