CVE-2026-32246 is an improper authentication vulnerability (CWE-287) discovered in the Tinyauth authentication and authorization server, specifically affecting versions prior to 5.0.3. Tinyauth implements OpenID Connect (OIDC) for authentication flows, including multi-factor authentication (MFA) using Time-based One-Time Passwords (TOTP). The vulnerability arises because the OIDC authorization endpoint incorrectly issues authorization codes to sessions where the user has successfully verified their password but has not completed the TOTP verification step. This means that an attacker who has compromised or otherwise obtained a user's password can bypass the second factor entirely by exploiting the authorization endpoint to obtain valid OIDC tokens. These tokens can then be used to access protected resources, effectively compromising the integrity of the authentication process. The vulnerability does not require user interaction and can be exploited remotely with low complexity, but requires the attacker to have the user's password (privilege required). The scope is high since it affects the authentication mechanism and can lead to full account takeover without completing the second factor. The issue was addressed in Tinyauth version 5.0.3 by correcting the authorization endpoint logic to enforce completion of TOTP verification before issuing authorization codes. No public exploits have been reported yet, but the vulnerability poses a significant risk to any organization using vulnerable versions of Tinyauth for MFA enforcement.

This vulnerability severely undermines the security guarantees of multi-factor authentication in Tinyauth deployments, allowing attackers who have obtained user passwords to bypass the second factor and gain unauthorized access. The impact includes potential account takeover, unauthorized access to sensitive systems and data, and possible lateral movement within affected networks. Organizations relying on Tinyauth for critical authentication services could face data breaches, compliance violations, and reputational damage. Since Tinyauth is an authentication server, compromise can affect multiple dependent applications and services, amplifying the impact. The vulnerability does not affect availability but compromises integrity and confidentiality. The ease of exploitation (no user interaction, remote network attack vector) combined with the high scope and impact makes this a critical risk for organizations using vulnerable versions.

The primary mitigation is to upgrade all Tinyauth deployments to version 5.0.3 or later, where the vulnerability is fixed. Organizations should immediately audit their authentication infrastructure to identify any instances running vulnerable versions. Additionally, implement compensating controls such as monitoring and alerting on anomalous authorization code requests or unusual token issuance patterns. Enforce strong password policies and consider additional layers of security such as device-based authentication or behavioral analytics to detect suspicious access attempts. Review and tighten access controls on the Tinyauth server itself to limit exposure. Conduct thorough incident response readiness in case of suspected compromise. Finally, ensure that all dependent applications validate tokens properly and consider implementing short token lifetimes to limit the window of misuse.