Executive brief
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth
Affected products
- Go github.com/steveiliop56/tinyauth
Junglewise Threat Intelligence
CVE-2026-33544: GO-2026-5296 - Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth
CVE-2026-33544 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/steveiliop56/tinyauth (Go). Vendors: Go.
Related threats
- Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login req
- GO-2026-4689 - Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth
- GO-2026-4688 - Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth