GO-2026-5296 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth...

CVE-2026-33544 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent...

Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Summary All three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider...

br.eti.clairton:ds-test (0.4.0), com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (>=1.2.0, <=1.2.1) +149 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.4.0.final)

io.undertow:undertow-core MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - br.eti.clairton:ds-test 0.4.0 - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service =1.2.0...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.0.1), org.hawkular.agent:hawkular-dmr-client (>=0.6.0.final, <=0.14.0.final) +50 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (1.0.1.final)

org.wildfly.core:wildfly-server MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.0.1 -...

br.eti.clairton:ds-test (0.4.0), com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (>=1.2.0, <=1.2.1) +101 more potentially affected by CVE-2023-4061 via org.wildfly.core:wildfly-controller (2.2.0.final)

org.wildfly.core:wildfly-controller MAVEN version 2.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-controller and may be impacted: - br.eti.clairton:ds-test 0.4.0 -...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.1.0), io.mangoo:mangooio-core (>=1.3.0, <=1.3.2) +101 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.3.3.final)

io.undertow:undertow-core MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.1.0 - io.mangoo:mangooio-core =1.3.0...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.1.0), io.mangoo:mangooio-core (>=1.3.0, <=1.3.2) +101 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.3.3.final)

io.undertow:undertow-core MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.1.0 - io.mangoo:mangooio-core =1.3.0...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.1.0), io.mangoo:mangooio-core (>=1.3.0, <=1.3.2) +101 more potentially affected by CVE-2020-1757 via io.undertow:undertow-core (1.3.3.final)

io.undertow:undertow-core MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.1.0 - io.mangoo:mangooio-core =1.3.0...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.1.0), org.hawkular.agent:hawkular-wildfly-agent (>=0.15.0.final, <=0.15.3.final) +114 more potentially affected by CVE-2020-35510 via org.jboss.remoting:jboss-remoting (4.0.14.final)

org.jboss.remoting:jboss-remoting MAVEN version 4.0.14.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.remoting:jboss-remoting and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.1.0 -...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.0.1), de.svenkubiak:mangooio-hibernate-extension (1.0.0) +72 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.2.9.final)

io.undertow:undertow-core MAVEN version 1.2.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.0.1 -...