CVE-2026-108162mediumCWE-348

CVE-2026-108162: falha de média gravidade em smp46 pingvin-share-x

Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pingvin-share-x

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
smp46 · pingvin-share-x
CVEs relacionadas — smp46 pingvin-share-x

No mesmo produto, das mais perigosas para as menos.

CVE-2026-49467HIGHTOTP enrollment hijack: password gate skipped due to unawaited promiseEPSS 0.6%CVE-2026-108157CRITICALPingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email LinkingEPSS 0.5%CVE-2026-44196CRITICALPingvin Share X: TOTP Authentication Bypass via Password-only LoginEPSS 0.3%CVE-2026-108163MEDIUMPingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTLEPSS 0.2%