CVE-2026-33544
published 2026-04-02CVE-2026-33544: Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService…
PriorityP344high7.7CVSS 3.1
AVNACHPRLUIRSCCHIHAN
EPSS
0.34%
26.0th percentile
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | steveiliop56_tinyauth | >= 0 < 1.0.1-0.20260401140714-fc1d4f2082a5 | 1.0.1-0.20260401140714-fc1d4f2082a5 |
| steveiliop56 | tinyauth | < 5.0.5 | 5.0.5 |
| tinyauth | tinyauth | < 5.0.5 | 5.0.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
osv·2026-04-01
CVE-2026-33544 [HIGH] Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
### Summary
All three OAuth service implementations (`GenericOAuthService`, `GithubOAuthService`, `GoogleOAuthService`) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between `VerifyCode()` and `Userinfo()` causes one user to receive a session with the other user's identity.
### Details
The [`OAuthBrokerService.GetService()`](https://github.com/steveiliop56/tinyauth/blob/592b7ded24959013f8af63ab9930254c752c8c8e/internal/service/oauth_broker_service.go#L70-L72) returns a single shared instance per provider for every request. The O
GHSA
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
ghsa·2026-04-01
CVE-2026-33544 [HIGH] CWE-362 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
### Summary
All three OAuth service implementations (`GenericOAuthService`, `GithubOAuthService`, `GoogleOAuthService`) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between `VerifyCode()` and `Userinfo()` causes one user to receive a session with the other user's identity.
### Details
The [`OAuthBrokerService.GetService()`](https://github.com/steveiliop56/tinyauth/blob/592b7ded24959013f8af63ab9930254c752c8c8e/internal/service/oauth_broker_service.go#L70-L72) returns a single shared instance per provider for every request. The O
No detection rules found.
No public exploits indexed.
2026-04-02
Published