CVE-2026-108162

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions prior to 1.22.0

Description An issue exists where the application unconditionally trusts proxy headers in backend/src/main.ts, allowing unauthenticated remote attackers to bypass per-IP rate limiting. By rotating spoofed X-Forwarded-For values, attackers can perform brute-force attacks on passwords and TOTP codes or forge logged client IP addresses. This affects the following API endpoints: '/api/auth/signIn', '/api/auth/signIn/totp', and '/api/auth/resetPassword'.

Recommendations Update to version 1.22.0 or later.