CVE Intelligence
Analysis AI-assisted

CVE-2026-44196: Pingvin Share X Authentication Bypass Skips TOTP Two-Factor Check

CVE-2026-44196 is a critical authentication bypass in Pingvin Share X, a self-hosted file sharing platform, described as affecting versions from 1.14.1 through 1.16.2. According to the record, an attacker who already holds a valid username and password can skip the TOTP second-factor requirement. The issue is fixed in 1.16.3, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-44196 affects Pingvin Share X, a self-hosted file sharing platform. According to the GitHub Security Advisory, versions from 1.14.1 to 1.16.2 allow an attacker with a valid username and password to bypass the TOTP second-factor requirement. The fix is available in 1.16.3.

Impact

  • A successful bypass of the second factor could let an attacker reach an account without completing the TOTP step.
  • The attacker still needs the user's password, so the record does not describe this as an unauthenticated flaw.
  • The CVSS 3.1 base score of 9.1 is recorded as critical, with high confidentiality and integrity impact and no availability impact in the vector.

Affected products and versions

  • Product: Pingvin Share X (self-hosted file sharing).
  • Affected range stated in the description: 1.14.1 through 1.16.2.
  • Fixed version: 1.16.3.
  • The structured affected and fixes fields in the record are empty, so the version range comes from the description text.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Pingvin Share X to version 1.16.3, the fixed release named in the record.
  • Until the upgrade is applied, limit exposure of the instance, for example by restricting login and administrative access where feasible, and review accounts for unexpected sessions.
  • Enforce strong, unique passwords and check for shared or reused credentials, since the bypass depends on the password being known.

Detection guidance

  • Review authentication logs for successful sessions that lack a corresponding second-factor verification event, if the application records such events.
  • Monitor for logins from unfamiliar sources on accounts that use TOTP.
  • Treat unexplained access as a potential incident and follow your internal response process.

Limitations of the available information

  • The record does not describe the technical mechanism of the bypass, and this analysis does not attempt to reconstruct it.
  • The main source consulted is the GitHub advisory; no independent second advisory is included in the record.
  • Whether the application logs the TOTP step in a way that supports detection is unknown.
  • The record shows a Deferred source status and empty affected and fixes fields, so the version scope should be verified against the upstream advisory.

Frequently asked questions

Is this vulnerability exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which version fixes it?

Version 1.16.3, according to the description in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.