CVE-2026-33544
High
Description
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.
SeverityHigh
CVSS7.7
Exploit probability—
ProductTinyauth
PublishedApr 2, 2026
First seenApr 2, 2026
Weakness typeCWE-362Race condition
How to fix
Update
- tinyauth tinyauth5.0.5 or later
- github.com/steveiliop56/tinyauth1.0.1-0.20260401140714-fc1d4f2082a5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tinyauth tinyauth | v < 5.0.5 | 5.0.5 |
| github.com/steveiliop56/tinyauthGo | v < 1.0.1-0.20260401140714-fc1d4f2082a5 | 1.0.1-0.20260401140714-fc1d4f2082a5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.