CVE-2026-32245 Tinyauth's OIDC authorization codes are not bound to client on token exchange

What is CVE-2026-32245?

CVE-2026-32245 is a medium-severity authentication bypass vulnerability in steveiliop56 tinyauth, published on 12 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.

Weakness: CWE-863

Which versions are affected by CVE-2026-32245?

3 open source packages ship an affected version, including github.com/steveiliop56/tinyauth. It affects 1 product.

Products include Tinyauth Tinyauth.

How do I fix CVE-2026-32245?

Upgrade github.com/steveiliop56/tinyauth to 1.0.1-20260311144920-9eb2d33064b7 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-32245 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32245 exists.

Other vulnerabilities in steveiliop56 tinyauth

• CVE-2026-32246 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint High 8.5
• CVE-2026-33544 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xg2q-62g2-cvcm, GO-2026-4689.