CVE-2026-49467

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions 1.5.0 through 1.18.0

Description A flaw allows an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The issue stems from a missing await keyword during calls to the asynchronous verifyPassword() method in authTotp.service.ts and the authenticateUser() method in auth.service.ts. In JavaScript, an unawaited Promise (an object representing the eventual completion of an asynchronous operation) is always truthy. Consequently, the logic designed to throw a ForbiddenException when a password is incorrect fails to execute because the system evaluates the existence of the Promise object instead of its resolved boolean result.

Recommendations Update to version 1.18.1. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.