Junglewise Threat Intelligence

CVE-2026-32246: GO-2026-4688 - Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth

CVE-2026-32246 · Severity: low · CVSS 3.1 · Published 2026-03-12

Technologies: github.com/steveiliop56/tinyauth (Go). Vendors: Go.

Executive brief

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth

Affected products

Go github.com/steveiliop56/tinyauth

Related threats

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login req
GO-2026-5296 - Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth
GO-2026-4689 - Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth