PT-2026-109649 · Unknown · Pingvin Share
CVE-2026-108163
·
Published
2026-10-10
·
Updated
2026-10-10
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Pingvin Share X versions prior to 1.22.0
Description
An ineffective rate limiting issue exists because throttler TTL (Time To Live) values, which are intended to be specified in seconds, are incorrectly interpreted as milliseconds. This allows unauthenticated attackers to send a high volume of requests to the '/api/auth/signIn', '/api/auth/signIn/totp', and '/api/auth/resetPassword' endpoints to perform brute-force attacks against passwords and TOTP codes.
Recommendations
Update to version 1.22.0 or later.
Exploit
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pingvin Share