Github.Com Steveiliop56 Tinyauth vulnerabilities

CVE-2026-33544 [HIGH] CWE-362 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances Tinyauth has OAuth account confusion via shared mutable state on singleton service instances ### Summary All three OAuth service implementations (`GenericOAuthService`, `GithubOAuthService`, `GoogleOAuthService`) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login

CVE-2026-32246 [HIGH] CWE-287 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint ### Summary The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. ### Details When a user with TOTP en

CVE-2026-32245 [MEDIUM] CWE-863 Tinyauth's OIDC authorization codes are not bound to client on token exchange Tinyauth's OIDC authorization codes are not bound to client on token exchange ### Summary The OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized