PT-2026-25055 · Tinyauth · Tinyauth
E1024X
·
Published
2026-03-12
·
Updated
2026-03-25
·
CVE-2026-32245
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Tinyauth versions prior to 5.0.3
Description
Tinyauth is an authentication and authorization server. The OIDC token endpoint does not verify that the client exchanging an authorization code is the same client to which the code was originally issued. This allows a malicious OIDC client operator to exchange another client's authorization code using their own credentials, potentially obtaining tokens for users who did not authorize their application. This violates RFC 6749 Section 4.1.3. The issue occurs during token exchange at the
/api/oidc/token endpoint, where the ClientID stored with the authorization code is not compared against the requesting client's ID (creds.ClientID). The vulnerable parameter is the code parameter in the token exchange request.Recommendations
Update Tinyauth to version 5.0.3 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tinyauth