CVE-2026-33544
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
12th
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.
| CWE | CWE-362 |
| Vendor | steveiliop56 |
| Product | tinyauth |
| Published | Apr 2, 2026 |
| Last Updated | Apr 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for steveiliop56 tinyauth
Be the first to know when new high vulnerabilities affecting steveiliop56 tinyauth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
steveiliop56 / tinyauth
< 5.0.5