PT-2026-40332 · Unknown · Pingvin Share

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-44196

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pingvin Share X versions 1.14.1 through 1.16.2

Description An authentication bypass allows an attacker with a valid username and password to skip the second-factor authentication (TOTP) requirement. Time-based One-Time Password (TOTP) is a temporary code generated by an app to provide an extra layer of security.

Recommendations Update to version 1.16.3.

Fix

Improper Authentication

Weakness Enumeration

CWE-697

CWE-287

Related Identifiers

CVE-2026-44196

Affected Products

Pingvin Share

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44196 · Security Note
• https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq · Note
• https://t.me/CVEtracker/53538 · Telegram Post
• https://twitter.com/CVEnew/status/2054340978757030304 · Twitter Post