Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck

CVE-2026-108157Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

High 8.1

In plain English

A high-severity improper authentication in pingvin-share-x from smp46. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.

Affected products (as reported)

Vendor	Product	Versions
smp46	pingvin-share-x	0.19.0 – before 1.22.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-wrcg-4874-45p7) vendor-advisory
Patch Commit patch
https://github.com/smp46/pingvin-share-x/blob/de7ffecf9bfc4976993149a5c4c98efe35161424/backend/src/oauth/oauth.service.ts#L158-L175 technical-description
pingvin-share-x v1.22.0 Release Notes release-notes
https://github.com/smp46/pingvin-share-x product
VulnCheck Advisory: Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking third-party-advisory