CVE-2026-44196 — Pingvin Share X: TOTP Authentication Bypass via Password-only Login

CVE-2026-44196

Pingvin Share X: TOTP Authentication Bypass via Password-only Login PUBLISHED

Description (CNA)

Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.

Affected (CNA)

Vendor / product	Versions
smp46 / pingvin-share-x	affected >= 1.14.1, < 1.16.3

CWE

CWE-287, CWE-697

References

https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.