Vulnerabilities

TI-2026-64273 CVE-2026-97736 · GHSA-rp6g-vgfj-26cr

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.

LOW 24

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00208 Published 2026-09-25 Fixed in 5.1.3 CWE-777

TI-2026-25937 CVE-2026-33544 · GHSA-9q5m-jfc4-wc92

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

HIGH 69

Tinyauth is an authentication and authorization server.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00351 Published 2026-04-02 Fixed in 5.0.5, 1.0.1-0.20260401140714-fc1d4f2082a5 CWE-362

TI-2026-24775 CVE-2026-32246 · GHSA-3q28-qjrv-qr39

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

HIGH 70

Tinyauth is an authentication and authorization server.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00307 Published 2026-03-12 Fixed in 5.0.3, 1.0.1-20260311144920-9eb2d33064b7 CWE-287

TI-2026-24774 CVE-2026-32245 · GHSA-xg2q-62g2-cvcm

Tinyauth's OIDC authorization codes are not bound to client on token exchange

MEDIUM 62

Tinyauth is an authentication and authorization server.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00298 Published 2026-03-12 Fixed in 5.0.3, 1.0.1-20260311144920-9eb2d33064b7 CWE-863

Vulnerabilities

Filters

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Tinyauth's OIDC authorization codes are not bound to client on token exchange