steveiliop56/tinyauth Security Advisories | GitStock

high2026-04-01

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

GHSA-9q5m-jfc4-wc92 · CVE-2026-33544

high2026-03-12

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

GHSA-3q28-qjrv-qr39 · CVE-2026-32246

medium2026-03-12

Tinyauth's OIDC authorization codes are not bound to client on token exchange

GHSA-xg2q-62g2-cvcm · CVE-2026-32245