Description

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T18:17:30.637Z",
  "pubdate": "2026-08-12T18:17:30.637Z",
  "executiveSummary": "A password verification bypass vulnerability exists in Pingvin Share versions 1.5.0 through 1.18.0. The flaw allows an attacker to completely circumvent password verification mechanisms during the management of Time-based One-Time Password (TOTP) settings and user authentication routines.\nThe vulnerability arises from a semantic programming error involving asynchronous JavaScript promises, where an unawaited function call evaluates to a truthy object regardless of the underlying computational result. This logical failure prevents the application from throwing expected authentication exceptions when incorrect credentials are provided.\nSuccessfully exploiting this vulnerability grants unauthorized users the ability to bypass security checks intended to restrict sensitive administrative and authentication configurations, potentially leading to unauthorized account access and administrative control over TOTP settings.\nThe risk implication is critical, as attackers with network access to the self-hosted platform can leverage this flaw to subvert core authentication controls. Exploitation requires no prior administrative privileges, although standard network reachability to the application is necessary.\nNo official workarounds exist other than administrative database intervention for locked-out users, necessitating an immediate software upgrade to resolve the underlying codebase flaw.",
  "technicalDetails": "The root cause of the vulnerability stems from a missing await keyword on asynchronous method calls within authTotp.service.ts and auth.service.ts. Specifically, calls to the asynchronous verifyPassword method and the authenticateUser method are executed without awaiting their resolution.\nIn JavaScript and TypeScript, an unawaited Promise object always evaluates to a truthy value in conditional statements. The application logic was designed to evaluate the resolved boolean outcome of the password verification routine and throw a ForbiddenException if the verification failed. Because the promise itself is evaluated instead of its awaited resolution, the conditional statement checking for invalid passwords never evaluates to true.\nConsequently, the exception intended to halt execution when a password is incorrect is never triggered. An attacker can supply arbitrary or invalid password inputs during sensitive operations, such as modifying TOTP settings, and the application will incorrectly process the request as successfully authenticated.\nThe attack flow proceeds as follows: First, the attacker initiates a request interacting with TOTP settings or authentication endpoints that invoke verifyPassword or authenticateUser. Second, the attacker submits an invalid or arbitrary password string. Third, the application invokes the asynchronous verification method but fails to await the Promise. Fourth, the unawaited Promise resolves to a truthy object, bypassing the failure handling block. Finally, the application processes the subsequent workflow as if the user successfully authenticated, granting unauthorized access to the targeted functionality.\nAffected components include the authentication and TOTP service layers specifically located in authTotp.service.ts and auth.service.ts across product versions 1.5.0 through 1.18.0. The vulnerability requires network exposure to the Pingvin Share instance but does not mandate prior administrative privileges for the initial verification bypass.\nPost-exploitation impact includes unauthorized modification of multi-factor authentication configurations, potential account takeover, and degradation of the overall integrity of the self-hosted file sharing platform's access control mechanisms."
}