TI-2026-24774 Aliases CVE-2026-32245 GHSA-xg2q-62g2-cvcm

Tinyauth's OIDC authorization codes are not bound to client on token exchange

MEDIUM 62CWE-863Published 2026-03-12 · Updated 2026-03-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed tinyauth (steveiliop56): 5.0.3github.com/steveiliop56/tinyauth (Go): 1.0.1-20260311144920-9eb2d33064b7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
steveiliop56	tinyauth	before 5.0.3	5.0.3	Patch available	CNA
—	github.com/steveiliop56/tinyauth (Go)	before 1.0.1-20260311144920-9eb2d33064b7	1.0.1-20260311144920-9eb2d33064b7	Patch available	GHSA-xg2q-62g2-cvcm

tinyauth Vendorsteveiliop56 Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA
github.com/steveiliop56/tinyauth (Go) Vendor— Affected before 1.0.1-20260311144920-9eb2d33064b7 Fixed in 1.0.1-20260311144920-9eb2d33064b7 Patch available GHSA-xg2q-62g2-cvcm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tinyauth:tinyauth::::::::	up to 5.0.2	Vulnerable	steveiliop56

cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:* Versions up to 5.0.2 Vulnerable ·steveiliop56

Remediation

Fix · CNA tinyauth (steveiliop56) Fixed in 5.0.3
Fix · GHSA-xg2q-62g2-cvcm github.com/steveiliop56/tinyauth (Go) Fixed in 1.0.1-20260311144920-9eb2d33064b7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32245
2026-10-03 Alias added: GHSA-xg2q-62g2-cvcm

References

Other 3

TI-2026-24775 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint CVSS 3.1HIGH 8.5
TI-2026-25937 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences