Threat Intelligence Database

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.

Tinyauth versions prior to 5.1.0 have a timing discrepancy vulnerability that allows remote attackers to distinguish between existing and nonexistent usernames during authentication attempts. This is due to faster response times when a username is missing compared to when bcrypt password verification occurs for existing users. The vulnerability enables attackers to enumerate valid usernames, facilitating targeted credential attacks. The issue is fixed in version 5.1.0.

Tinyauth versions prior to 5.1.2 have a vulnerability where case-sensitive hostname comparisons allow authenticated low-privilege users to bypass per-application access controls by using differently cased hostnames. This occurs because reverse proxies route hostnames case-insensitively, but Tinyauth does not, leading to missed access control lookups and permissive access. Unauthenticated users and global login allowlists are not bypassed. The issue is fixed in version 5.1.2.

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+8#cve#cve-2026-32246#cwe-287

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-32245#cwe-863