CVE-2026-32245

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Incorrect Authorization pada tinyauth. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violates RFC 6749 Section 4.1.3. This vulnerability is fixed in 5.0.3.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/steveiliop56/tinyauth/commit/b2a1bfb1f532e87f205fa3afa3fc9f148c53ab89 patch
• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm exploit · advisory pihak ketiga
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.3 release notes