CVE-2026-32246 - Vulnerability Analysis

Overview

Tinyauth < 5.0.3 contains an authentication bypass caused by allowing users with TOTP-pending sessions to obtain authorization codes, letting attackers bypass second factor with only password knowledge, exploit requires valid user password.

Severity & Score

Impact

Attackers can bypass two-factor authentication and obtain valid tokens, compromising user accounts.

Mitigation

Update to version 5.0.3 or later.

References

• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🟠 CVE-2026-32246 - High (8.5) Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a use... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32246/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner