Suse
CVE-2026-32245
MEDIUM
GHSA-xg2q-62g2-cvcm
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.
AnalysisAI
Medium severity vulnerability in TinyAuth. #
Technical ContextAI
Vulnerability Type: Incorrect Authorization (CWE-863) CVSS 3.1: 6.5/10.0 — Attack Vector: Network | Complexity: High | Privileges Required: Low | User Interaction: Required Attack Techniques: Authentication Bypass Source: https://github.com/steveiliop56/tinyauth Authentication bypass allows attackers to access protected resources without valid credentials.
Affected ProductsAI
Product: TinyAuth
RemediationAI
Patches available:
- https://github.com/steveiliop56/tinyauth/commit/b2a1bfb1f532e87f205fa3afa3fc9f148c53ab89
Security advisories:
- https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm
Update to the latest patched version as soon as possible.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today