v5.0.3

tinyauthapp/tinyauthv5.0.3Mar 11, 2026by steveiliop56

AI Summary

A security patch addressing two vulnerabilities discovered by @e1024x, focusing on authorization endpoint checks and token issuance.

Key Highlights

Security fixes for GHSA-xg2q-62g2-cvcm and GHSA-3q28-qjrv-qr39
Improved authorization endpoint security checks
Ensure client ID matches the code entry before issuing a token

Full Release Notes

# Tinyauth v5.0.3

> [!WARNING]
> This release contains security fixes, please update as soon as possible.

This release addresses [GHSA-xg2q-62g2-cvcm](https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm) and [GHSA-3q28-qjrv-qr39](https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39) discovered by @e1024x.

## Fixes

- Don't continue authentication on empty `X-Forwarded-*` headers. 
- Ensure user is logged in and not in the 2FA flow in the authorize endpoint
- Ensure client ID matches the code entry before issuing a token

## Technical

- Update dependencies
- Update translations

Please let me know of any issues so as I can fix them as soon as possible.