Tinyauth is an authentication server that stores OAuth PKCE verifiers and access tokens in mutable fields on singleton service instances. A race condition between VerifyCode() and Userinfo() during concurrent logins can cause one user to receive the session token belonging to another user. This results in unauthorized access and session impersonation, allowing an attacker to act with another user's privileges.

The vulnerability affects all versions of Tinyauth prior to release 5.0.5, including the GenericOAuthService, GithubOAuthService and GoogleOAuthService implementations. Any deployment of these services that has not been upgraded to 5.0.5 is potentially exploitable.

The vulnerability has a CVSS score of 7.7, indicating high severity. Although exact exploitability statistics are not available and the issue is not listed in the KEV catalog, the attack vector requires only parallel OAuth login attempts, which can be performed remotely by any authenticated or unauthenticated user. An attacker exploiting this race condition can impersonate another user or gain unauthorized access to resources, representing a significant risk to confidentiality and integrity.