CVE-2026-33544

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33544
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33544.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33544
Aliases
Downstream
Related
Published
2026-04-02T15:00:38.450Z
Modified
2026-08-05T03:32:13.877303649Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
Details

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider concurrently, a race condition between VerifyCode() and Userinfo() causes one user to receive a session with the other user's identity. This issue has been patched in version 5.0.5.

Database specific 
{
    "cwe_ids": [
        "CWE-362"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33544.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/tinyauthapp/tinyauth

Affected ranges

Type
GIT
Repo
https://github.com/tinyauthapp/tinyauth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f26c2171610d5c2dfbba2edb6ccd39490e349803
Fixed
fc1d4f2082a5a4d26305d40baeec209937127684
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.0-beta.1
v0.2.0
v0.2.0-beta.1
v0.3.0
v0.3.0-beta.1
v0.3.0-beta.2
v0.3.0-beta.3
v1.*
v1.0.0
v1.0.0-alpha.1
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-beta.1
v2.0.1
v2.0.2
v2.0.2-beta.1
v2.0.2-beta.2
v2.1.0
v2.1.0-alpha.1
v2.1.0-alpha.2
v2.1.1
v2.1.1-beta.1
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.1
v3.0.1-beta.1
v3.1.0
v3.1.0-alpha.1
v3.1.0-beta.1
v3.1.0-beta.2
v3.1.0-exp.1
v3.1.0-exp.2
v3.1.0-exp.3
v3.2.0
v3.2.0-alpha.1
v3.2.0-beta.1
v3.2.0-beta.2
v3.2.0-beta.3
v3.2.0-beta.4
v3.2.0-beta.5
v3.2.0-beta.6
v3.2.1
v3.2.1-beta.1
v3.3.0
v3.3.0-alpha.1
v3.3.0-alpha.2
v3.3.0-alpha.3
v3.3.1
v3.3.1-beta.1
v3.4.0
v3.4.0-alpha.1
v3.4.0-beta.1
v3.4.0-beta.2
v3.4.1
v3.4.1-beta.1
v3.5.0
v3.5.0-alpha.1
v3.5.0-alpha.2
v3.6.0
v3.6.0-beta.1
v3.6.0-beta.2
v3.6.1
v3.6.1-beta.1
v3.6.1-beta.2
v3.6.1-beta.3
v3.6.2
v3.6.2-beta.1
v3.6.2-beta.2
v3.6.2-beta.3
v3.6.2-beta.4
v4.*
v4.0.0
v4.0.0-alpha.1
v4.0.0-alpha.2
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-rc.1
v4.0.1
v4.0.1-beta.1
v4.0.1-beta.2
v4.1.0
v4.1.0-beta.1
v4.1.0-rc.1
v4.1.0-rc.2
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0-alpha.3
v5.0.0-alpha.4
v5.0.0-alpha.5
v5.0.0-beta.1
v5.0.0-beta.2
v5.0.0-beta.3
v5.0.0-beta.4
v5.0.0-rc.1
v5.0.0-rc.2
v5.0.1
v5.0.1-beta.1
v5.0.1-rc.1
v5.0.2
v5.0.2-beta.1
v5.0.2-beta.2
v5.0.3
v5.0.3-beta.1
v5.0.4
v5.0.5-beta.1
v5.0.5-beta.2
v5.0.5-beta.3
v5.0.5-rc.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33544.json"