CVE-2026-108157

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions 0.19.0 through 1.21.x

Description An improper authentication flaw allows remote unauthenticated attackers to take over accounts, including administrator accounts, by abusing automatic OAuth email linking. The issue occurs within the signUp() function of the OAuthService due to a missing email verified check in the GenericOidcProvider. This allows an attacker to register a victim's unverified email on an enabled OAuth/OIDC provider to sign in as the victim and bypass TOTP (Time-based One-Time Password), which is a temporary password valid for a short period.

Recommendations Update Pingvin Share X to version 1.22.0 or later.