CVE-2026-49467

The record

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.

Affected packages

Related vulnerabilities

• CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the… CWE-303
• CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating… CWE-303
• CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CWE-303
• CVE-2026-11430 Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook… CWE-303
• CVE-2026-10050 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to… CWE-303
• CVE-2026-59309 VMware vCenter contains an authentication bypass vulnerability in the VMware Directory… CWE-303
• CVE-2026-50360 Incorrect implementation of authentication algorithm in Windows SMB Server allows an… CWE-303
• CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme… CWE-303