Tinyauth’s OAuth services keep PKCE verifiers and access tokens in mutable fields on singleton instances. When two users start an OAuth flow to the same provider at the same time, a competition between the VerifyCode() and Userinfo() functions can result in one user’s session pointing to the other user’s identity. This flaw allows one authenticated user to receive and use another user’s session, potentially granting access to data or actions that the attacker should not own. The weakness is classified as a race condition (CWE‑362).

The affected component is the Tinyauth authentication server. All three OAuth service implementations—GenericOAuthService, GithubOAuthService, and GoogleOAuthService—are vulnerable in releases prior to version 5.0.5 of the application. The issue was addressed and fixed in the 5.0.5 release.

The CVSS score of 7.7 signals a high severity. The EPSS score of less than 1 % suggests exploitation is unlikely, and the vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the flaw remotely by initiating two OAuth login requests for the same provider at nearly the same time, without needing special privileges or additional configuration. The attack path is straightforward and only requires control over the OAuth endpoints used by legitimate users.