Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108157— Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Quick assessment

Affected
smp46 pingvin-share-x
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pingvin Share 在版本 0.19.0 至 1.22.0（不包括 1.22.0）中存在一个不正确的身份验证漏洞。攻击者可以利用 OAuthService.signUp() 中的自动 OAuth 邮箱链接功能，对远程未认证的攻击者实现账户接管。具体而言，攻击者可以在启用了 OAuth/OIDC 提供方的情况下，注册受害者未验证的邮箱，并通过利用 GenericOidcProvider 中缺失的 email_verified 检查，以受害者身份登录，包括管理员账户，同时绕过双因素认证（TOTP）。

CVSS 8.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
smp46 pingvin-share-x 0.19.0< 1.22.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108157

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
Source: CVE Program / CVE List V5
Vulnerability Description
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
smp46 pingvin-share-x 0.19.0 ~ 1.22.0 -

II. Public POCs for CVE-2026-108157

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108157

请登录查看更多情报信息。

Other References for CVE-2026-108157 (6)

IV. Related Vulnerabilities

Same product: pingvin-share-x
Same vendor: smp46
Same weakness: CWE-287

V. Comments for CVE-2026-108157

No comments yet

Leave a comment