CVE-2026-32246
High
Description
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.
SeverityHigh
CVSS8.5
Exploit probability—
ProductTinyauth
PublishedMar 12, 2026
First seenMar 12, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- github.com/steveiliop56/tinyauth1.0.1-20260311144920-9eb2d33064b7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tinyauth tinyauth | v ≤ 5.0.2 | — |
| github.com/steveiliop56/tinyauthGo | v < 1.0.1-20260311144920-9eb2d33064b7, No range specified | 1.0.1-20260311144920-9eb2d33064b7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.