CVE-2026-108157 — Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automat…
Published: 2026-10-09 · CVSS: 9.2 · CVSS 4.0
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7