TI-2026-25937 Aliases CVE-2026-33544 GHSA-9q5m-jfc4-wc92

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

HIGH 69CWE-362Published 2026-04-02 · Updated 2026-04-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00351 28th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed tinyauth (steveiliop56): 5.0.5github.com/steveiliop56/tinyauth (Go): 1.0.1-0.20260401140714-fc1d4f2082a5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
steveiliop56	tinyauth	before 5.0.5	5.0.5	Patch available	CNA
—	github.com/steveiliop56/tinyauth (Go)	before 1.0.1-0.20260401140714-fc1d4f2082a5	1.0.1-0.20260401140714-fc1d4f2082a5	Patch available	GHSA-9q5m-jfc4-wc92

tinyauth Vendorsteveiliop56 Affected before 5.0.5 Fixed in 5.0.5 Patch available CNA
github.com/steveiliop56/tinyauth (Go) Vendor— Affected before 1.0.1-0.20260401140714-fc1d4f2082a5 Fixed in 1.0.1-0.20260401140714-fc1d4f2082a5 Patch available GHSA-9q5m-jfc4-wc92

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tinyauth:tinyauth::::::::	before 5.0.5	Vulnerable	steveiliop56

cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:* Versions before 5.0.5 Vulnerable ·steveiliop56

Remediation

Fix · CNA tinyauth (steveiliop56) Fixed in 5.0.5
Fix · GHSA-9q5m-jfc4-wc92 github.com/steveiliop56/tinyauth (Go) Fixed in 1.0.1-0.20260401140714-fc1d4f2082a5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33544
2026-10-03 Alias added: GHSA-9q5m-jfc4-wc92

References

Other 2

TI-2026-24775 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint CVSS 3.1HIGH 8.5
TI-2026-24774 Tinyauth's OIDC authorization codes are not bound to client on token exchange CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences