{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-49467 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-49467 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-49467 is a high-severity authentication bypass vulnerability in smp46 pingvin-share-x, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-49467 and fix it if it is affected.\n\nWhat it is: CVE-2026-49467 is a high-severity authentication bypass vulnerability in smp46 pingvin-share-x, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-49467 in the wild and no public exploit code.\n\nAffected product: smp46 pingvin-share-x. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-49467/ (Markdown: https://insights.sbomify.com/CVE-2026-49467/index.md)","id":"CVE-2026-49467","markdown":"https://insights.sbomify.com/CVE-2026-49467/index.md","name":"CVE-2026-49467","record":{"aliases":["GHSA-59q6-jvp6-w282"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["security_bypass","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Self-hosted file sharing","requires_auth":"low_privilege","summary":"Attackers can bypass password verification to hijack TOTP enrollment in Pingvin Share X due to unawaited promises, requiring an upgrade to fix.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-304","name":"Missing Critical Step in Authentication"},{"id":"CWE-303","name":"Incorrect Implementation of Authentication Algorithm"}],"description":"Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"TOTP enrollment hijack: password gate skipped due to unawaited promise","id":"CVE-2026-49467","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"LiteLLM: Authentication Bypass via Host Header Injection","id":"CVE-2026-49468"},"packages":[],"prev":{"headline":"Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes","id":"CVE-2026-49466"},"products":["pingvin-share-x"],"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-14","vendors":["smp46"]},"summary":"Attackers can bypass password verification to hijack TOTP enrollment in Pingvin Share X due to unawaited promises, requiring an upgrade to fix.","url":"https://insights.sbomify.com/CVE-2026-49467/"}