Threats affecting pkg:github/Pangolin

Pangolin versions before 1.22.0 have an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by manipulating a URL parameter in the share-link authentication endpoint. This flaw enables attackers with a single valid share link to authenticate across different organizations and bypass all configured authentication methods, including SSO, passwords, PINs, email allowlists, and header authentication.