https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:27:32.094077+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-32246 CVE-2026-32246 — Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint 2026-10-07T03:27:32.111759+00:00

Affected: steveiliop56 tinyauth

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.