CVE-2026-33544: 
vulnerability analysis and mitigation

CVE-2026-33544 is an OAuth account confusion vulnerability in tinyauth caused by a race condition in shared mutable singleton state across concurrent OAuth login requests. All three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances, allowing one user's token to overwrite another's during concurrent logins. The vulnerability affects tinyauth versions prior to 5.0.5 and was disclosed on April 1, 2026. It carries a CVSS v3.1 base score of 7.7 (High) (Github Advisory).

The root cause is CWE-362 (Race Condition): OAuthBrokerService.GetService() returns a single shared instance per OAuth provider for every incoming request, and the OAuth flow stores intermediate state — specifically the PKCE verifier and access token — as mutable struct fields on this singleton. In the callback handler (oauth_controller.go lines 136–143), service.VerifyCode(code) stores the exchanged token on the singleton, but a concurrent request's VerifyCode() can overwrite that field before GetUser() → Userinfo() reads it, causing the wrong user's identity claims to be returned. A secondary variant involves PKCE verifier overwrites during concurrent oauthURLHandler calls, causing the OAuth provider to reject the code exchange (denial-of-service). Go's race detector confirms 4 data races on the token and verifier fields, and without the detector, the token overwrite rate was measured at 99.9% (9,985/10,000 iterations) (Github Advisory, Security Advisory).

A successful exploit allows an attacker who times their OAuth callback to race with a victim's callback to obtain a tinyauth session bearing the victim's identity (email, name, group memberships), granting unauthorized access to all resources the victim is permitted to access through tinyauth's ACL system. Both confidentiality and integrity are highly impacted, as the attacker can read and act on behalf of the victim across all proxied applications. Additionally, the PKCE verifier overwrite variant causes concurrent OAuth logins for the same provider to reliably fail, resulting in a denial-of-service for legitimate users (Github Advisory).

1. Prerequisite: The attacker must have a valid account with the same OAuth provider (e.g., GitHub, Google) configured on the target tinyauth instance and must be able to initiate an OAuth login flow.
2. Reconnaissance: Identify a tinyauth instance (version < 5.0.5) with OAuth login enabled for a provider also used by the target victim.
3. Initiate concurrent OAuth flows: The attacker and victim (or the attacker using two sessions/browsers) both click "Login with [Provider]" on the same tinyauth instance at nearly the same time, causing both to be redirected to the OAuth provider for authorization.
4. Race the callbacks: Both users authorize and are redirected back to tinyauth's OAuth callback endpoint with their respective authorization codes nearly simultaneously.
5. Token overwrite: At time t0, Request A (attacker) calls service.VerifyCode(codeA), storing tokenA on the singleton. At t1, Request B (victim) calls service.VerifyCode(codeB), overwriting the singleton with tokenB. At t2, Request A calls broker.GetUser() → Userinfo(), which reads tokenB from the singleton.
6. Session hijack: Request A (attacker's session) receives the victim's identity claims (email, name, groups) and a tinyauth session cookie is issued for the victim's account, granting the attacker access to all resources the victim is authorized for (Security Advisory).

• Logs: Tinyauth application logs showing two OAuth callback requests for the same provider arriving within milliseconds of each other from different source IPs or sessions; log entries where a user session is created with an email address that does not match the OAuth account the requester initiated.
• Network: Simultaneous or near-simultaneous HTTP requests to the tinyauth OAuth callback endpoint (e.g., /api/oauth/callback?provider=github) from different clients.
• Session/Cookie Anomalies: A user reporting being logged in as another user's account; session records in the tinyauth database where the OAuth provider, email, and originating IP are inconsistent with the expected user.
• Application Behavior: Repeated OAuth login failures (HTTP redirects to /error) during periods of concurrent logins, indicative of the PKCE verifier DoS variant (Security Advisory).

Upgrade tinyauth to version 5.0.5 or later, which refactors the OAuth flow to eliminate shared mutable singleton state — PKCE verifiers and tokens are now passed through method parameters and stored in per-session cookies (tinyauth-oauth) rather than on the service struct (v5.0.5 Release, Patch Commit). No configuration-based workaround is available for the race condition; the only effective remediation is upgrading. The maintainer has flagged this release as a security fix requiring immediate update (Github Advisory).

The vulnerability was discovered and reported by researcher kq5y, credited in both the GitHub Security Advisory and the v5.0.5 release notes (v5.0.5 Release). The maintainer responded promptly, publishing the advisory and patched release on the same day (April 1, 2026) with a clear warning to update immediately. No broader media coverage or significant social media discussion has been identified beyond the GitHub advisory ecosystem.