Skip to content
OpenAdvisories

Product · steveiliop56

tinyauth

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-32245

    Tinyauth's OIDC authorization codes are not bound to client on token exchange

    Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another c…

    steveiliop56 tinyauth github.com/steveiliop56/tinyauth Go