CVE-2026-44196 is an improper authentication vulnerability (CWE-287) in Pingvin Share X, a self-hosted file sharing platform by smp46. From versions 1.14.1 up to but not including 1.16.3, an attacker who has obtained valid user credentials can bypass the Time-based One-Time Password (TOTP) second-factor authentication requirement. This effectively reduces the multi-factor authentication protection to single-factor, increasing the risk of unauthorized access. The vulnerability was addressed and fixed in version 1.16.3.

An attacker who has compromised a user's password can completely bypass the second-factor authentication, allowing unauthorized access to the affected system with the same privileges as the legitimate user. This significantly undermines the security provided by multi-factor authentication, potentially exposing sensitive files and data shared via Pingvin Share X. There are no known exploits in the wild at this time.

Upgrade Pingvin Share X to version 1.16.3 or later, where this authentication bypass vulnerability has been fixed. Until the upgrade is applied, be aware that possession of valid user credentials can allow bypass of second-factor authentication. No official patch links or vendor advisory were provided, so verify the upgrade availability from the vendor or trusted sources.