CVE-2026-32246highCWE-287

CVE-2026-32246: falha de alta gravidade em steveiliop56 tinyauth

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Publicada em

Seguir esta CVE+ Monitorar tinyauth+ Monitorar github.com/steveiliop56/tinyauth

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.3%
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Produtos afetados
steveiliop56 · tinyauth
CVEs relacionadas — steveiliop56 tinyauth

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33544HIGHTinyauth has OAuth account confusion via shared mutable state on singleton service instancesEPSS 0.4%CVE-2026-32245MEDIUMTinyauth's OIDC authorization codes are not bound to client on token exchangeEPSS 0.3%