CVE-2026-49467 TOTP enrollment hijack: password gate skipped due to unawaited promise
Attackers can bypass password verification to hijack TOTP enrollment in Pingvin Share X due to unawaited promises, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49467?
CVE-2026-49467 is a high-severity authentication bypass vulnerability in smp46 pingvin-share-x, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.
Which versions are affected by CVE-2026-49467?
How do I fix CVE-2026-49467?
No fix has been published for CVE-2026-49467 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-49467 being exploited?
There is no known exploitation of CVE-2026-49467 in the wild and no public exploit code.
Sources
Also known as GHSA-59q6-jvp6-w282.