steveiliop56

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

steveiliop56 records in CISA KEV

No steveiliop56 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tinyauth 3 records HIGH

Records

4 records

TI-2026-24775 CVE-2026-32246 · GHSA-3q28-qjrv-qr39

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

HIGH 70

Tinyauth is an authentication and authorization server.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00307 Published 2026-03-12 Fixed in 5.0.3, 1.0.1-20260311144920-9eb2d33064b7 CWE-287

TI-2026-25937 CVE-2026-33544 · GHSA-9q5m-jfc4-wc92

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

HIGH 69

Tinyauth is an authentication and authorization server.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00351 Published 2026-04-02 Fixed in 5.0.5, 1.0.1-0.20260401140714-fc1d4f2082a5 CWE-362

TI-2026-24774 CVE-2026-32245 · GHSA-xg2q-62g2-cvcm

Tinyauth's OIDC authorization codes are not bound to client on token exchange

MEDIUM 62

Tinyauth is an authentication and authorization server.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00298 Published 2026-03-12 Fixed in 5.0.3, 1.0.1-20260311144920-9eb2d33064b7 CWE-863

TI-2026-64273 CVE-2026-97736 · GHSA-rp6g-vgfj-26cr

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.

LOW 24

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00208 Published 2026-09-25 Fixed in 5.1.3 CWE-777

Open these records in search →

Critical	0
High	2
Medium	2
Low	0
No CVSS	0