CVE-2026-32246 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
Attackers with valid passwords can bypass TOTP/2FA via the OIDC authorize endpoint to obtain tokens and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32246?
CVE-2026-32246 is a high-severity authentication bypass vulnerability in steveiliop56 tinyauth, published on 12 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.
Weakness: CWE-287
Which versions are affected by CVE-2026-32246?
3 open source packages ship an affected version, including github.com/steveiliop56/tinyauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/steveiliop56/tinyauth Go | All versions | None |
github.com/steveiliop56/tinyauth Go | All versions | 1.0.1-20260311144920-9eb2d33064b7 |
github.com/steveiliop56/tinyauth Go | All versions | 1.0.1-20260311144920-9eb2d33064b7 |
Products include Tinyauth Tinyauth.
How do I fix CVE-2026-32246?
Upgrade github.com/steveiliop56/tinyauth to 1.0.1-20260311144920-9eb2d33064b7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-32246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32246 exists.
Other vulnerabilities in steveiliop56 tinyauth
Sources
Also known as GHSA-3q28-qjrv-qr39, GO-2026-4688.