CVE-2026-108157

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-108157

Pingvin Share X versions 0.19.0 before 1.22.0 are vulnerable to an improper authentication flaw in the OAuthService.signUp() function. The root cause is a missing email_verified check in the GenericOidcProvider, which allows unauthenticated remote attackers to perform an account takeover . By reg...