CVE-2026-32246
published 2026-03-12CVE-2026-32246: Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password…
PriorityP344high7.1CVSS 3.1
AVNACLPRLUINSUCLIHAN
EPSS
0.27%
18.9th percentile
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | steveiliop56_tinyauth | >= 0 < 1.0.1-20260311144920-9eb2d33064b7 | 1.0.1-20260311144920-9eb2d33064b7 |
| steveiliop56 | tinyauth | < 5.0.3 | 5.0.3 |
| tinyauth | tinyauth | <= 5.0.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
ghsa·2026-03-12
CVE-2026-32246 [HIGH] CWE-287 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
### Summary
The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.
### Details
When a user with TOTP enabled logs in at `POST /api/user/login`, the server creates a session with `TotpPending: true` and returns a session cookie. The context middleware (`internal/middleware/context_middleware.go:56-66`) correctly sets `TotpPending: true` and does not set `IsLoggedIn` for these sessions.
However, the OIDC authorize handler (`internal/controller/oidc_controller.go:105-116`) only checks whether a us
OSV
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
osv·2026-03-12
CVE-2026-32246 [HIGH] Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
### Summary
The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.
### Details
When a user with TOTP enabled logs in at `POST /api/user/login`, the server creates a session with `TotpPending: true` and returns a session cookie. The context middleware (`internal/middleware/context_middleware.go:56-66`) correctly sets `TotpPending: true` and does not set `IsLoggedIn` for these sessions.
However, the OIDC authorize handler (`internal/controller/oidc_controller.go:105-116`) only checks whether a us
OSV
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth
osv·2026-03-12
CVE-2026-32246 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint in github.com/steveiliop56/tinyauth.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/steveiliop56/tinyauth before v1.0.1-20260311144920-9eb2d33064b7.
No detection rules found.
No public exploits indexed.
2026-03-12
Published