CVE-2026-108163 — Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthentica…
Published: 2026-10-10 · CVSS: 6.9 · CVSS 4.0
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7