CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
Remote attackers can take over accounts, including administrators, by exploiting missing email verification checks in OAuth sign-up flows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108157?
CVE-2026-108157 is a critical authentication bypass vulnerability in smp46 pingvin-share-x, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Weakness: CWE-287
Which versions are affected by CVE-2026-108157?
How do I fix CVE-2026-108157?
No fix has been published for CVE-2026-108157 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-108157 being exploited?
There is no known exploitation of CVE-2026-108157 in the wild and no public exploit code.
Sources
Also known as GHSA-7p7c-6qwr-q8j7, GHSA-wrcg-4874-45p7.