CVE-2026-49467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49467", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-30T04:17:43.094Z", "datePublished": "2026-08-12T17:02:26.556Z", "dateUpdated": "2026-08-14T21:52:13.060Z"}, "containers": {"cna": {"title": "TOTP enrollment hijack: password gate skipped due to unawaited promise", "problemTypes": [{"descriptions": [{"cweId": "CWE-303", "lang": "en", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-304", "lang": "en", "description": "CWE-304: Missing Critical Step in Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-59q6-jvp6-w282", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-59q6-jvp6-w282"}], "affected": [{"vendor": "smp46", "product": "pingvin-share-x", "versions": [{"version": ">= 1.5.0, < 1.18.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T17:02:26.556Z"}, "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database."}], "source": {"advisory": "GHSA-59q6-jvp6-w282", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T21:52:03.631125Z", "id": "CVE-2026-49467", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T21:52:13.060Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49467", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T21:52:03.631125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T21:52:08.956Z"}}], "cna": {"title": "TOTP enrollment hijack: password gate skipped due to unawaited promise", "source": {"advisory": "GHSA-59q6-jvp6-w282", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "smp46", "product": "pingvin-share-x", "versions": [{"status": "affected", "version": ">= 1.5.0, < 1.18.1"}]}], "references": [{"url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-59q6-jvp6-w282", "name": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-59q6-jvp6-w282", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-303", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-304", "description": "CWE-304: Missing Critical Step in Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T17:02:26.556Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49467", "state": "PUBLISHED", "dateUpdated": "2026-08-14T21:52:13.060Z", "dateReserved": "2026-05-30T04:17:43.094Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T17:02:26.556Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pingvin-share-x", "vendor": "smp46", "versions": [{"status": "affected", "version": ">= 1.5.0, < 1.18.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database."}, {"lang": "es", "value": "Pingvin Share X es una plataforma segura y f\u00e1cil para compartir archivos autoalojada. Una vulnerabilidad en las versiones 1.5.0 a la 1.18.0 permite a un atacante eludir la verificaci\u00f3n de contrase\u00f1a al gestionar la configuraci\u00f3n de Contrase\u00f1a de Un Solo Uso Basada en Tiempo (TOTP). La causa ra\u00edz es una palabra clave \u201cawait\u201d faltante en las llamadas al m\u00e9todo as\u00edncrono \u201cverifyPassword\u201d en \u201cauthTotp.service.ts\u201d y al m\u00e9todo \u201cauthenticateUser\u201d en \u201cauth.service.ts\u201d. En JavaScript, una \u201cPromise\u201d no esperada es siempre veraz. As\u00ed, la l\u00f3gica destinada a lanzar una \u201cForbiddenException\u201d cuando una contrase\u00f1a es incorrecta. Nunca se ejecuta porque la expresi\u00f3n eval\u00faa la existencia del objeto \u201cPromise\u201d en lugar de su resultado booleano resuelto. La vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.18.1 al asegurar que todas las llamadas de autenticaci\u00f3n as\u00edncronas sean debidamente esperadas. No hay soluciones alternativas oficiales. Si un usuario queda bloqueado, un administrador debe restablecer manualmente el estado TOTP del usuario en la base de datos."}], "id": "CVE-2026-49467", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49467", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T21:52:03.631125Z", "version": "2.0.3"}}]}, "published": "2026-08-12T18:17:30.637", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-59q6-jvp6-w282"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-303"}, {"lang": "en", "value": "CWE-304"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,1.18.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pingvin-share-x", "source": "cna", "vendor": "smp46"}, "product": "pingvin-share-x", "vendor": "smp46"}], "created": "2026-08-12T19:45:08.056081+00:00", "updated": "2026-08-13T00:00:09.093761+00:00", "vendors": ["smp46", "smp46$PRODUCT$pingvin-share-x"]}