CVE-2026-44196

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44196", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T15:13:47.570Z", "datePublished": "2026-05-12T17:40:28.894Z", "dateUpdated": "2026-05-14T19:49:00.840Z"}, "containers": {"cna": {"title": "Pingvin Share X: TOTP Authentication Bypass via Password-only Login", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-697", "lang": "en", "description": "CWE-697: Incorrect Comparison", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq"}], "affected": [{"vendor": "smp46", "product": "pingvin-share-x", "versions": [{"version": ">= 1.14.1, < 1.16.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:40:28.894Z"}, "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3."}], "source": {"advisory": "GHSA-j679-vp39-qwqq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T19:48:14.609120Z", "id": "CVE-2026-44196", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:49:00.840Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T19:48:14.609120Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:48:45.574Z"}}], "cna": {"title": "Pingvin Share X: TOTP Authentication Bypass via Password-only Login", "source": {"advisory": "GHSA-j679-vp39-qwqq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "smp46", "product": "pingvin-share-x", "versions": [{"status": "affected", "version": ">= 1.14.1, < 1.16.3"}]}], "references": [{"url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq", "name": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T17:40:28.894Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44196", "state": "PUBLISHED", "dateUpdated": "2026-05-14T19:49:00.840Z", "dateReserved": "2026-05-05T15:13:47.570Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T17:40:28.894Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pingvin-share-x", "vendor": "smp46", "versions": [{"status": "affected", "version": ">= 1.14.1, < 1.16.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3."}, {"lang": "es", "value": "Pingvin Share X es una plataforma segura y sencilla de autoalojamiento para compartir archivos. Desde la versi\u00f3n 1.14.1 hasta la 1.16.2, una vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n permite a un atacante que ha obtenido un nombre de usuario y una contrase\u00f1a v\u00e1lidos omitir completamente el requisito de autenticaci\u00f3n de segundo factor (TOTP). Aunque, un atacante a\u00fan necesita la contrase\u00f1a del usuario para alcanzar esta etapa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.16.3."}], "id": "CVE-2026-44196", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44196", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T19:48:14.609120Z", "version": "2.0.3"}}]}, "published": "2026-05-12T18:17:29.730", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-697"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.14.1,1.16.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pingvin-share-x", "source": "cna", "vendor": "smp46"}, "product": "pingvin-share-x", "vendor": "smp46"}], "created": "2026-05-12T19:45:15.631227+00:00", "updated": "2026-05-13T10:37:53.422835+00:00", "vendors": ["smp46", "smp46$PRODUCT$pingvin-share-x"]}