Skip to content
OpenAdvisories

Product · tinacms

auth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-63506

    Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

    Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of …

    tinacms tinacms next-tinacms-azure auth npm