Security Advisory

CVE-2026-32245

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-12 18:57:51

Last updated 2026-03-12 20:46:29

Assigner GitHub_M

State PUBLISHED

Description

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another clients authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.

← Browse all CVEs View on cve.org ↗