Skip to content
OpenAdvisories

Package · Go

github.com/steveiliop56/tinyauth

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.7
    CVE-2026-33544

    Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

    Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton …

    steveiliop56 tinyauth github.com/steveiliop56/tinyauth Go
  • High 8.5
    CVE-2026-32246

    Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

    Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password…

    steveiliop56 tinyauth github.com/steveiliop56/tinyauth Go