Description

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-10T14:16:37.397Z",
  "pubdate": "2026-10-10T14:16:37.397Z",
  "executiveSummary": "Pingvin Share versions prior to 1.22.0 contain a critical rate limit bypass vulnerability originating from improper handling of HTTP proxy headers.\nThe vulnerability allows unauthenticated remote attackers to circumvent IP-based throttling mechanisms by manipulating the X-Forwarded-For header.\nThis flaw facilitates brute-force attacks against authentication endpoints, including login, TOTP verification, and password reset functionalities.\nBy spoofing source IP addresses, attackers can effectively evade automated security controls, mask their origin, and perform sustained credential stuffing or brute-force operations against user accounts.\nThe impact is significant, as it lowers the barrier for account takeover and compromises the integrity of the authentication process.\nExploitation is trivial and does not require prior authentication or elevated privileges, making it a high-risk exposure for any internet-facing deployment.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation within backend/src/main.ts, where the application unconditionally trusts HTTP proxy headers provided by the client.\nBy failing to validate or strip incoming proxy headers such as X-Forwarded-For, the application allows the client to dictate the perceived origin IP address.\nBecause the rate-limiting middleware relies on these headers to identify and track individual requesters, an attacker can rotate these values with every request.\nThe exploitation flow begins with the attacker targeting the /api/auth/signIn, /api/auth/signIn/totp, or /api/auth/resetPassword endpoints.\nFor each iteration of a brute-force payload, the attacker injects a unique or randomized IP address into the X-Forwarded-For header.\nThe backend consumes this header, updates its internal state for rate tracking based on the spoofed address, and treats the request as if it originated from a new, compliant user.\nThis behavior effectively nullifies per-IP throttling, as the rate-limiting logic never associates the high-frequency traffic with a single source.\nBeyond brute-force utility, this mechanism allows for the forgery of logged client IP addresses in application logs, complicating forensic investigations and incident response efforts.\nThe vulnerability affects versions prior to 1.22.0 and is exploitable over standard HTTP/HTTPS protocols without any requirement for authenticated sessions.\nSuccessful exploitation allows attackers to bypass security boundaries intended to prevent automated abuse, leading to a high probability of account compromise through credential exhaustion or TOTP brute-forcing.\nThe lack of server-side verification of the proxy chain—specifically failing to verify if the request originated from a trusted internal proxy—serves as the primary security failure."
}