CVE-2026-33544 Details

A race condition vulnerability has been identified in Tinyauth, an authentication and authorization server, prior to version 5.0.5. All three OAuth service implementations—GenericOAuthService, GithubOAuthService, and GoogleOAuthService—store PKCE verifiers and access tokens as mutable struct fields on singleton instances. These instances are shared across all concurrent requests, creating a scenario where two users can inadvertently interfere with each other's OAuth login processes. When two users initiate login with the same provider at the same time, a conflict arises between the VerifyCode() and Userinfo() methods. This conflict can cause one user to receive a session associated with the other user's identity, leading to unauthorized access to resources. Additionally, the vulnerability allows for a denial-of-service condition, where concurrent logins for the same provider fail due to the overwritten verifiers.

Users are advised to update to Tinyauth version 5.0.5 or later, where this vulnerability has been patched.