auth vulnerabilities

1 known vulnerability in auth from Tinacms. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  tinacms: Authorization Bypass Through User-Controlled Key

  CVE-2026-63506Sep 16, 2026Tinacms

  Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of t