{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apingvinsharepingvin_share/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pingvinshare:pingvin_share:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-108157"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pingvin Share (0.19.0 \u003c= version \u003c 1.22.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Pingvin Share"],"content_html":"\u003cp\u003ePingvin Share versions 0.19.0 through 1.21.x are affected by an improper authentication vulnerability, tracked as CVE-2026-108157. The vulnerability exists within the OAuthService.signUp() function and the GenericOidcProvider, where the application fails to validate the email_verified claim when performing OAuth or OpenID Connect (OIDC) registrations. A remote, unauthenticated attacker can exploit this flaw by registering an arbitrary email address associated with an enabled OAuth/OIDC provider. By doing so, the attacker can associate their own OIDC registration with a victim's email address, effectively taking over the victim's account. This method bypasses existing password protections and Multi-Factor Authentication (MFA) requirements, including TOTP. Because administrative accounts can be targeted, this vulnerability presents a critical risk for unauthorized access and administrative control over the Pingvin Share instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full account takeover of any user within the target Pingvin Share instance, including administrative accounts. Attackers can bypass all secondary authentication mechanisms, including TOTP, leading to potential data exfiltration, unauthorized file sharing, and full administrative configuration control of the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Pingvin Share to version 1.22.0 or later immediately to address CVE-2026-108157.\u003c/li\u003e\n\u003cli\u003eAudit user account modifications and unexpected OAuth provider associations within the application logs for activity matching account registration timeframes.\u003c/li\u003e\n\u003cli\u003eTemporarily disable OIDC/OAuth registration if immediate patching is not possible and monitor application access logs for unusual registration patterns.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-09T17:27:01Z","date_published":"2026-10-09T17:27:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pingvin-share-auth-bypass/","summary":"Pingvin Share versions 0.19.0 through 1.21.x contain an authentication bypass vulnerability (CVE-2026-108157) allowing attackers to perform account takeover by exploiting improper email verification during OAuth registration.","title":"Improper Authentication Vulnerability in Pingvin Share","url":"https://feed.craftedsignal.io/briefs/2026-10-pingvin-share-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pingvinshare:pingvin_share:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}