{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/steveiliop56/tinyauth","cve_ids":["CVE-2026-32245"],"ecosystem":"Go","epss":0.00353,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xg2q-62g2-cvcm","id":"tcs_01M5KGF8PMYHQ4CB0ENDKF3W0F","modified_at":"2026-03-23T04:52:55.595862Z","published_at":"2026-03-12T20:57:42Z","references":["https://osv.dev/vulnerability/GO-2026-4689","https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm","https://github.com/steveiliop56/tinyauth/commit/b2a1bfb1f532e87f205fa3afa3fc9f148c53ab89","https://github.com/steveiliop56/tinyauth/releases/tag/v5.0.3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4689","url":"https://osv.dev/vulnerability/GO-2026-4689"}],"summary":"Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth"}