Pingvin Share X: Account takeover via automatic OAuth email linking

Summary

Pingvin Share X from 0.19.0 before 1.22.0 links OAuth/OIDC logins to existing local accounts by email address without requiring verified emails. A remote, unauthenticated attacker who registers a victim's unverified email address on an enabled OAuth/OIDC provider can sign in as that victim, including administrators, and bypass TOTP. The attack requires that OAuth/OIDC sign-in is enabled and that the provider does not verify email addresses.

Affected

• Pingvin Share X 0.19.0 up to but not including 1.22.0
• Default configuration is unaffected; OAuth/OIDC sign-in must be enabled

Fixed in

• Fixed in Pingvin Share X 1.22.0

Workaround

• Unknown. No vendor-published workaround is available.
• Interim measure (not from the vendor): disable OAuth/OIDC sign-in until the update is installed.

Exploitation

• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• No evidence of exploitation in the wild found.
• No public proof of concept found.

Our recommendation

• Update Pingvin Share X to version 1.22.0 or later. Versions below 1.22.0 are no longer receiving security updates.
• If OAuth/OIDC sign-in is not needed, disable it until the update is done.
• If it is needed, allow only identity providers that verify email addresses.
• Review administrator accounts and recent OAuth account links, and check authentication logs for unusual sign-ins.
• Upgrading to 1.22.0 also fixes CVE-2026-108163 and CVE-2026-108162.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-wrcg-4874-45p7 github.com
• Pingvin Share X release v1.22.0 github.com
• Fix commit 07aa8c0a github.com
• VulnCheck advisory www.vulncheck.com
• Vulnerable code in oauth.service.ts github.com
• OSV entry CVE-2026-108157 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:45.