Tinyauth Tinyauth vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Tinyauth Tinyauth: 4 record(s), with affected versions and fixes.
cpe:2.3:a:tinyauth:tinyauth

CVE-2026-97736 Medium · 5.4 CWE-777 Sep 25, 2026

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is…

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

CVE-2026-33544 High · 7.7 CWE-362 Apr 2, 2026

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.

CVE-2026-32246 High · 7.1 CWE-287 Mar 12, 2026

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.

CVE-2026-32245 Medium · 6.5 CWE-863 Mar 12, 2026

Tinyauth's OIDC authorization codes are not bound to client on token exchange

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.