https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:59:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275909 EUVD-2026-275909 https://cve.radiocsirt.org/vuln/euvd-2026-275909 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32246 <p>Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user&#39;s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.</p> <p>Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user&#39;s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32246 https://cve.radiocsirt.org/vuln/ghsa-3q28-qjrv-qr39 <p><strong>Affected:</strong> Go: github.com/steveiliop56/tinyauth</p> <p>### Summary</p> <p>The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user&#39;s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.</p> <p>### Details</p> <p>When a user with TOTP enabled logs in at `POST /api/user/login`, the server creates a session with `TotpPending: true` and returns a session cookie. The context middleware (`internal/middleware/context_middleware.go:56-66`) correctly sets `TotpPending: true` and does not set `IsLoggedIn` for these sessions.</p> <p>However, the OIDC authorize handler (`internal/controller/oidc_controller.go:105-116`) only checks whether a user context exists via `utils.GetContext(c)`. It does not check `IsLoggedIn` or `TotpPending`. Since the context middleware populates a context for TOTP-pending sessions (with the username filled in), `GetContext` succeeds, and the handler proceeds to issue an authorization code at line 156 using the username from the incomplete session.</p> <p>For comparison, the proxy controller (`internal/controller/proxy_controller.go:176-179`) correctly blocks TOTP-incomplete sessions by checking `IsBasicAuth &amp;&amp; TotpEnabled` and setting `IsLoggedIn = false`. The OIDC authorize handler has no equivalent guard.</p> <p>`StoreCode` at `internal/service/oidc_service.go:305` saves the code with the victim&#39;s `sub` claim. The attacker then exchanges this code at `POST /api/oidc/token` for…</p> <p><strong>Affected:</strong> Go: github.com/steveiliop56/tinyauth</p> <p>### Summary</p> <p>The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user&#39;s password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.</p> <p>### Details</p> <p>When a user with TOTP enabled logs in at `POST /api/user/login`, the server creates a session with `TotpPending: true` and returns a session cookie. The context middleware (`internal/middleware/context_middleware.go:56-66`) correctly sets `TotpPending: true` and does not set `IsLoggedIn` for these sessions.</p> <p>However, the OIDC authorize handler (`internal/controller/oidc_controller.go:105-116`) only checks whether a user context exists via `utils.GetContext(c)`. It does not check `IsLoggedIn` or `TotpPending`. Since the context middleware populates a context for TOTP-pending sessions (with the username filled in), `GetContext` succeeds, and the handler proceeds to issue an authorization code at line 156 using the username from the incomplete session.</p> <p>For comparison, the proxy controller (`internal/controller/proxy_controller.go:176-179`) correctly blocks TOTP-incomplete sessions by checking `IsBasicAuth &amp;&amp; TotpEnabled` and setting `IsLoggedIn = false`. The OIDC authorize handler has no equivalent guard.</p> <p>`StoreCode` at `internal/service/oidc_service.go:305` saves the code with the victim&#39;s `sub` claim. The attacker then exchanges this code at `POST /api/oidc/token` for…</p> https://cve.radiocsirt.org/vuln/ghsa-3q28-qjrv-qr39