A critical authentication bypass in the tinyauth server allows attackers with a compromised password to circumvent second-factor authentication and obtain valid OIDC tokens.

This vulnerability is an improper authentication flaw (CWE-287) within the OIDC authorization endpoint. It allows an authenticated user, who has successfully provided a primary password but has not yet completed the TOTP process, to illicitly obtain authorization codes and tokens.

The ability to bypass multi-factor authentication poses a severe risk to organizational identity and access management. With a CVSS score of 8.5, this high-severity flaw enables unauthorized access to systems or data protected by OIDC, potentially leading to full account takeover, data exfiltration, or the compromise of downstream applications relying on the tinyauth server for authentication.

Immediate Action: Update the tinyauth server to version 5.0.3 or later immediately to apply the security fix.

Proactive Monitoring: Review OIDC authorization logs for unusual patterns, specifically monitoring for frequent session initiations that do not result in successful completion of the TOTP verification step.

Compensating Controls: If immediate patching is not possible, restrict access to the OIDC authorization endpoint at the network or web application firewall level to trusted internal sources only.

Public Exploit Available: Unknown.

Given the high impact of bypassing multi-factor authentication, administrators should prioritize this update. Ensure that all instances of tinyauth are identified and upgraded to version 5.0.3 without delay to prevent potential account takeovers.