Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-33544Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
High 7.7
In plain English
A high-severity race condition in tinyauth from steveiliop56. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/steveiliop56/tinyauth | 1.0.1-0.20260401140714-fc1d4f2082a5 | GHSA-9q5m-jfc4-wc92 |
| Go | github.com/steveiliop56/tinyauth | 1.0.1-0.20260401140714-fc1d4f2082a5 | GO-2026-5296 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| steveiliop56 | tinyauth | < 5.0.5 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N