CVE-2026-32246 HIGH

CVE-2026-32246: Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Vendor Steveiliop56
Product tinyauth
Weakness CWE-287 · Improper authentication
Published March 12, 2026
Last update March 12, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

What the vulnerability does

01Description

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.

Key dates

02Disclosure timeline

March 12, 2026 CVE published
March 12, 2026 Record updated