CVE-2026-44196 CRITICAL

CVE-2026-44196: Pingvin Share X: TOTP Authentication Bypass via Password-only Login

Vendor Smp46
Product pingvin-share-x
Weakness CWE-287 · Improper authentication
Published May 12, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 14, 2026 Record updated