CVE-2026-32246: Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

March 12, 2026 (updated March 13, 2026)

The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user’s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.

References

github.com/advisories/GHSA-3q28-qjrv-qr39
github.com/steveiliop56/tinyauth
github.com/steveiliop56/tinyauth/releases/tag/v5.0.3
github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39
nvd.nist.gov/vuln/detail/CVE-2026-32246

Code Behaviors & Features

Detect and mitigate CVE-2026-32246 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →