Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 10, 2026 · NIST NVD

   Detected

   Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

2. Oct 14, 2026 · NIST NVD

   Updated

   Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

Sources

• CVE.orgVulnerability recordCVE-2026-108163

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-108163

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-108163

  Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com