tinacms auth vulnerabilities

Latest tinacms auth CVEs

Newest publication first

1. CVE-2026-63506 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

   Published 2026-09-16

   High·CVSS 8.8 EPSS 0.52%

   Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site'...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.