CVE-2026-33544: OAuth Identity Confusion in tinyauth

The core of the vulnerability lies in the shared, mutable state of the OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService). When two users concurrently initiate OAuth login for the same provider, a race condition occurs between the VerifyCode() and Userinfo() functions. This allows one user's session to be hijacked by another, effectively granting the attacker access to the victim's account and associated data. The impact is significant, as an attacker can gain full control over the victim's account without needing their credentials. This could lead to data breaches, unauthorized actions, and further compromise of the system.

1. Reserved2026-03-20
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-10

The primary mitigation is to immediately upgrade to version 1.0.1-0.20260401140714-fc1d4f2082a5 or later. If upgrading is not immediately feasible, consider implementing a temporary workaround by ensuring that OAuth login requests are serialized to prevent concurrent processing. This can be achieved through rate limiting or queuing mechanisms. Monitor application logs for unusual login activity or session behavior. After upgrading, confirm the fix by performing concurrent OAuth login tests with different user accounts to verify that session isolation is maintained.