CVE-2026-32246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32246", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T14:47:05.685Z", "datePublished": "2026-03-12T18:59:20.875Z", "dateUpdated": "2026-03-12T20:46:24.238Z"}, "containers": {"cna": {"title": "Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39"}], "affected": [{"vendor": "steveiliop56", "product": "tinyauth", "versions": [{"version": "< 5.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T18:59:20.875Z"}, "descriptions": [{"lang": "en", "value": "Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3."}], "source": {"advisory": "GHSA-3q28-qjrv-qr39", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T20:43:38.639462Z", "id": "CVE-2026-32246", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:46:24.238Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32246", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T20:43:38.639462Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:43:39.320Z"}}], "cna": {"title": "Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint", "source": {"advisory": "GHSA-3q28-qjrv-qr39", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "steveiliop56", "product": "tinyauth", "versions": [{"status": "affected", "version": "< 5.0.3"}]}], "references": [{"url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39", "name": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T18:59:20.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32246", "state": "PUBLISHED", "dateUpdated": "2026-03-12T20:46:24.238Z", "dateReserved": "2026-03-11T14:47:05.685Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T18:59:20.875Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tinyauth", "vendor": "steveiliop56", "versions": [{"status": "affected", "version": "< 5.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:*", "matchCriteriaId": "937C7D56-16AC-4536-B16E-D9057C5971DE", "versionEndIncluding": "5.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3."}, {"lang": "es", "value": "Tinyauth es un servidor de autenticaci\u00f3n y autorizaci\u00f3n. Anteriormente a la 5.0.3, el endpoint de autorizaci\u00f3n OIDC permite a los usuarios con una sesi\u00f3n TOTP pendiente (contrase\u00f1a verificada, TOTP a\u00fan no completado) obtener c\u00f3digos de autorizaci\u00f3n. Un atacante que conoce la contrase\u00f1a de un usuario pero no su secreto TOTP puede obtener tokens OIDC v\u00e1lidos, eludiendo completamente el segundo factor. Esta vulnerabilidad se ha corregido en la versi\u00f3n 5.0.3."}], "id": "CVE-2026-32246", "lastModified": "2026-06-17T10:35:25.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32246", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T20:43:38.639462Z", "version": "2.0.3"}}]}, "published": "2026-03-12T19:16:19.577", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tinyauth", "source": "cna", "vendor": "steveiliop56"}, "product": "tinyauth", "vendor": "steveiliop56"}], "analysis": {"en": {"generated_at": "2026-03-19T21:52:38.614376+00:00", "value": {"mitigation_remediation": ["Upgrade Tinyauth to version 5.0.3 or later to disable the OIDC authorization endpoint for TOTP\u2011pending sessions."], "summary": {"action": "Immediate Patch", "impact": "Bypass Two\u2011Factor Authentication via OIDC"}, "threat_synthesis": {"affected_systems": "Affected vendor: steveiliop56; product: Tinyauth. All releases of the product with a version less than 5.0.3 are impacted. The provided CPE string cpe:2.3:a:tinyauth:tinyauth:* indicates that any instance of the software older than 5.0.3 satisfies the affected scope.", "description_and_impact": "The vulnerability exists in Tinyauth versions prior to 5.0.3 where the OIDC authorization endpoint will return an authorization code if a user has entered a valid password but has not yet completed the TOTP step. The attacker can therefore obtain OIDC tokens without the second factor. This is a CWE\u2011287 Authentication Bypass Vulnerability that can give the attacker unauthorized access to protected APIs and resources, compromising confidentiality and integrity.", "risk_and_exploitability": "The CVSS score of 8.5 indicates high severity. The EPSS score is below 1\u202f%, implying a low short\u2011term likelihood of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the likely attack vector is a remote, network\u2011based request to the OIDC authorize endpoint and requires the attacker to know a legitimate user\u2019s password. No local privileges are required. The exploitation chain consists of an OIDC authorization request for a session that is TOTP\u2011pending; the server erroneously issues the authorization code, which the attacker can redeem for access tokens. The attack does not depend on device compromise, so the breach scope can affect any user authenticated through the affected server."}}}}, "created": "2026-03-13T09:50:12.603871+00:00", "updated": "2026-03-23T09:54:58.168169+00:00", "vendors": ["steveiliop56", "steveiliop56$PRODUCT$tinyauth"]}