CyberSecBulletin

Steveiliop56 vulnerabilities

We track 2 vulnerabilities in Steveiliop56 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 2, 2026.

2vulnerabilities
0critical
2high
0exploited
7.4average CVSS score

Latest Steveiliop56 vulnerabilities

  • 7.7 High severity

    tinyauth: Concurrent Execution using Shared Resource with Improper Synchronization

    CVE-2026-33544Steveiliop56

    Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton i

  • 7.1 High severity

    tinyauth: Improper Authentication

    CVE-2026-32246Steveiliop56

    Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password