CVE-2026-49467: Pingvin Share X Auth Bypass Vulnerability

CVE-2026-49467 Overview

CVE-2026-49467 is an authentication bypass vulnerability in Pingvin Share X, a self-hosted file sharing platform. The flaw affects versions 1.5.0 through 1.18.0 and allows an authenticated attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing await keyword on asynchronous authentication calls in authTotp.service.ts and auth.service.ts. Because an unawaited JavaScript Promise is always truthy, the ForbiddenException intended to block invalid passwords never fires. The maintainers released a fix in version 1.18.1 that awaits all asynchronous authentication calls. See the GitHub Security Advisory GHSA-59q6-jvp6-w282 for full details.

Critical Impact
An authenticated attacker can enable, disable, or reset another account's TOTP protection without knowing the account password, undermining multi-factor authentication guarantees.

Affected Products

Pingvin Share X versions 1.5.0 through 1.18.0
The authTotp.service.ts component handling TOTP enable, verify, and disable flows
The auth.service.ts component exposing the authenticateUser method

Discovery Timeline

2026-08-12 - CVE-2026-49467 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-49467

Vulnerability Analysis

The vulnerability is an improper implementation of authentication (CWE-303) rooted in an asynchronous programming error. Pingvin Share X requires users to re-enter their password before changing sensitive TOTP settings. The server-side check calls verifyPassword and authenticateUser, both of which return a Promise that resolves to a boolean.

The developer omitted the await keyword when consuming these promises. In JavaScript, a Promise object is always truthy regardless of its eventual resolved value. Conditional logic that inspects the raw promise therefore treats every call as success, and the ForbiddenException guarding the endpoint never throws. Any authenticated user can submit an arbitrary password and proceed with TOTP mutation operations.

Root Cause

The defect is a missing await on asynchronous authentication calls inside authTotp.service.ts and auth.service.ts. The conditional expression evaluates the existence of the returned Promise rather than its resolved boolean, so the failure branch that should reject the request is dead code. Version 1.18.1 restores correct behavior by awaiting every authentication promise before branching on the result.

Attack Vector

Exploitation requires an authenticated session on the target Pingvin Share X instance. The attacker sends a TOTP management request with a fabricated password value. The server executes the intended TOTP change because the password verification silently passes. An attacker with hijacked session cookies, a low-privileged account, or physical access to an unlocked session can disable a victim's TOTP protection to weaken account security before a follow-on attack.

No public exploitation code is required. The vulnerability manifests through normal API calls to the TOTP management endpoints described in the GitHub Security Advisory.

Detection Methods for CVE-2026-49467

Indicators of Compromise

Unexpected changes to totpEnabled or totpSecret fields in the Pingvin Share X user database without corresponding successful password prompts in application logs.
TOTP enable, verify, or disable API requests that succeed despite being followed shortly by legitimate user complaints about lost MFA access.
Multiple TOTP state transitions on a single account within a short time window originating from unusual IP addresses or user agents.

Detection Strategies

Audit request logs for calls to TOTP management endpoints in authTotp.service.ts and correlate them against successful password prompts.
Compare the Pingvin Share X application version against the fixed release 1.18.1 across all deployments to identify exposed instances.
Review database change logs for modifications to TOTP-related columns that were not initiated by the account owner.

Monitoring Recommendations

Forward Pingvin Share X application and reverse proxy logs to a centralized SIEM for retention and correlation.
Alert on any TOTP state change followed by a password reset or session creation from a new source within 24 hours.
Monitor administrator activity that manually resets TOTP status, which the advisory identifies as the only recovery path for locked-out users.

How to Mitigate CVE-2026-49467

Immediate Actions Required

Upgrade every Pingvin Share X instance to version 1.18.1 or later without delay.
Force logout of all active sessions after upgrading to invalidate any sessions that may have exploited the bypass.
Review accounts whose TOTP status changed while running an affected version and require impacted users to re-enroll TOTP and rotate passwords.

Patch Information

The maintainers fixed CVE-2026-49467 in Pingvin Share X version 1.18.1. The patch adds the missing await keyword to every call of verifyPassword in authTotp.service.ts and authenticateUser in auth.service.ts, ensuring the resolved boolean drives the authorization decision. Details are published in GHSA-59q6-jvp6-w282.

Workarounds

No official workaround exists. Administrators must apply the patch to remediate the vulnerability.
If a user is locked out of TOTP as a result of exploitation, an administrator must manually reset the user's TOTP status directly in the database.
Restrict network access to Pingvin Share X to trusted users until the upgrade is completed to reduce the pool of potential attackers.

bash

# Upgrade Pingvin Share X container to the patched release
docker pull stonith404/pingvin-share:1.18.1
docker stop pingvin-share && docker rm pingvin-share
docker run -d --name pingvin-share \
  -p 3000:3000 \
  -v /opt/pingvin-share/data:/opt/app/backend/data \
  -v /opt/pingvin-share/images:/opt/app/frontend/public/img \
  stonith404/pingvin-share:1.18.1