CVE-2026-108163: Improper Restriction of Excessive Authentication Attempts in smp46 pingvin-share-x

CVE-2026-108163 describes an improper restriction of excessive authentication attempts in Pingvin Share X before version 1.22.0. The vulnerability arises because the throttler TTL values, intended to limit request rates, are specified in seconds but are misinterpreted as milliseconds. This flaw allows unauthenticated attackers to send a high volume of requests to the /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword endpoints without effective throttling. Consequently, attackers can perform brute-force attacks on user passwords and TOTP codes.

The vulnerability allows unauthenticated attackers to bypass intended rate limiting controls on authentication endpoints. This can lead to brute-force attempts to guess user passwords and TOTP codes, potentially compromising user accounts. The CVSS 4.0 score of 6.9 (medium severity) reflects the network attack vector, lack of required privileges or user interaction, and low to low integrity and availability impacts. There is no indication of known exploits in the wild.

A fixed version 1.22.0 or later should be applied to remediate this vulnerability. Since the affected versions are prior to 1.22.0, upgrading to 1.22.0 or newer will correct the throttler TTL interpretation and enforce proper rate limiting. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed beyond the version range, so check the vendor advisory for current remediation guidance.