Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33544 · Microsoft / collected KEV context

EUVD-2026-18254

GHSA-9q5m-jfc4-wc92

GO-2026-5296

cve-program · CVE-2026-33544

• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-9q5m-jfc4-wc92
• https://github.com/steveiliop56/tinyauth/commit/f26c2171610d5c2dfbba2edb6ccd39490e349803
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.5

euvd · EUVD-2026-18254

• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-9q5m-jfc4-wc92
• https://github.com/steveiliop56/tinyauth/commit/f26c2171610d5c2dfbba2edb6ccd39490e349803
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.5

nvd · CVE-2026-33544

• https://github.com/steveiliop56/tinyauth/commit/f26c2171610d5c2dfbba2edb6ccd39490e349803
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.5
• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-9q5m-jfc4-wc92

osv · GHSA-9q5m-jfc4-wc92

• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-9q5m-jfc4-wc92
• https://nvd.nist.gov/vuln/detail/CVE-2026-33544
• https://github.com/steveiliop56/tinyauth/commit/f26c2171610d5c2dfbba2edb6ccd39490e349803
• https://github.com/steveiliop56/tinyauth
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.5

osv · GO-2026-5296

• https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-9q5m-jfc4-wc92
• https://nvd.nist.gov/vuln/detail/CVE-2026-33544
• https://github.com/steveiliop56/tinyauth/commit/f26c2171610d5c2dfbba2edb6ccd39490e349803
• https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.5

No related operational record is retained in the current change model.