CVE-2026-108157

Summary

The Pingvin Share X application has an authentication flaw that allows remote attackers to hijack user accounts by exploiting missing email verification checks during OAuth sign-up. This vulnerability can lead to full account takeover including administrator privileges without requiring any credentials.

Exploitability

Exploitation requires registering a victim's unverified email with an enabled OAuth provider, making it moderately difficult but possible for attackers with access to the OAuth service, with a preconditions of having an enabled OIDC/OAuth provider and missing email verification checks.

Blast radius

The vulnerability could impact all users who have enabled OAuth/OIDC providers, potentially allowing attackers to gain administrative access and compromise entire systems through account takeover.

Detection

Monitor for unusual OAuth sign-up patterns where email addresses are registered without verification status, particularly when multiple accounts are created with the same unverified email address from different IP addresses or user agents.

Prioritized remediation

Upgrade to version 1.22.0 or later to fix the improper authentication vulnerability in OAuthService.signUp() and GenericOidcProvider.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.