Is CVE-2026-108157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108157 being exploited in the wild.

How severe is CVE-2026-108157?

High severity, with a CVSS score of 8.1, published 9 October 2026.

Which products and versions are affected?

Smp46 Pingvin Share X 0.19.0 to 1.21.x.

Is there a fix for CVE-2026-108157?

Yes: fixed in 1.22.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108157 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108157?

Check whether you run Smp46 Pingvin Share X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108157: Pingvin Share X improper authentication in OAuth

CVE-2026-108157 · Severity: high · CVSS 8.1 · Published 2026-10-09

Pingvin Share X is a self-hosted file sharing platform that allows secure document exchange. An authentication flaw in versions 0.19.0 to 1.21.x allows attackers to take over any account, including administrator accounts, by registering a victim's email address with an OAuth/OIDC provider and bypassing multi-factor authentication. This gives attackers full control over the platform and all shared files.

Technologies: Smp46 Pingvin Share X. Vendors: Smp46.

Quick answers

Is CVE-2026-108157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108157 being exploited in the wild.
How severe is CVE-2026-108157?: High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?: Smp46 Pingvin Share X 0.19.0 to 1.21.x.
Is there a fix for CVE-2026-108157?: Yes: fixed in 1.22.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108157 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108157?: Check whether you run Smp46 Pingvin Share X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.22.0

Technical details

The vulnerability exists in OAuthService.signUp() and GenericOidcProvider, which fail to verify the email_verified flag before linking OAuth identities during registration. An unauthenticated attacker can register a victim's unverified email on an enabled OAuth/OIDC provider and automatically sign in as that user, including bypassing TOTP. No authentication or user interaction is required beyond the ability to reach the OAuth endpoint.

Affected products

smp46 Pingvin Share X 0.19.0 to 1.21.x

Timeline

2026-10-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.