CVE-2026-63506: Tina CMS Authentication Bypass Vulnerability

CVE-2026-63506 Overview

CVE-2026-63506 is an authorization bypass vulnerability in TinaCMS, a headless content management system. The flaw affects @tinacms/auth versions prior to 1.1.4 and next-tinacms-azure versions prior to 15.0.1. The isAuthorized function accepts a request-controlled clientID and validates the bearer token against the attacker-selected TinaCloud application instead of the self-hosted site's configured application. An attacker with any TinaCloud account can submit their own app ID and valid token to a victim endpoint, causing the authorization layer to accept the attacker's verified status across the tenant boundary. This weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Successful exploitation grants attackers media listing, reading, upload, and deletion capabilities, plus GraphQL read, create, update, and delete operations on victim content — with no victim account or interaction required.

Affected Products

TinaCMS @tinacms/auth prior to 1.1.4
TinaCMS next-tinacms-azure prior to 15.0.1
Self-hosted TinaCMS deployments using TinaCloudBackendAuthProvider or the affected Azure media authorized callback

Discovery Timeline

2026-09-16 - CVE-2026-63506 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-63506

Vulnerability Analysis

The vulnerability resides in packages/@tinacms/auth/src/index.ts and packages/next-tinacms-azure/src/auth.ts. The isAuthorized function delegates validation to isUserAuthorized, passing along a clientID value sourced from the incoming request rather than from the site's server-side configuration. Because TinaCloud considers a token valid only against the app that issued it, allowing the requestor to select the target app collapses the tenancy boundary. Any attacker holding a valid TinaCloud token for their own app can therefore pass authorization against a completely unrelated victim site.

When TinaCloudBackendAuthProvider is deployed, this bypass exposes the full GraphQL surface, enabling read, create, update, and delete operations on victim content. When only the Azure media callback is affected, attackers can list, read, upload, and delete media assets.

Root Cause

The root cause is a trust boundary error: the server accepts the clientID supplied in the request context and uses it as the authorization key. Server-side authorization decisions must be scoped to values controlled by the application, not values supplied by the caller. This pattern matches [CWE-639] where a user-controlled parameter dictates the resource against which authentication is validated.

Attack Vector

Exploitation requires network access to a vulnerable TinaCMS endpoint and any valid TinaCloud account. The attacker submits an HTTP request bearing their own TinaCloud token and their own clientID. The victim server forwards the attacker-controlled clientID to isUserAuthorized, which confirms the token is valid for that app and returns a verified user. The victim application then treats the attacker as an authorized editor of the victim tenant.

typescript

// Security patch in packages/@tinacms/auth/src/index.ts (#7168)
// Scope TinaCloud authorization to the site's configured clientID
  * import { NextApiHandler } from 'next'
  * import { isAuthorized } from '@tinacms/auth'
  * const apiHandler: NextApiHandler = async (req, res) => {
- *   const user = await isAuthorized(req)
+ *   const user = await isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID)
  *   if (user && user.verified) {
  *       res.json({
  *         validUser: true,
// Source: https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af

typescript

// Security patch in packages/@tinacms/cli/src/cmds/init/prompts/authProvider.ts (#7168)
   },
   'tina-cloud': {
     configAuthProviderClass: '',
-    backendAuthProvider: 'TinaCloudBackendAuthProvider()',
+    backendAuthProvider:
+      'TinaCloudBackendAuthProvider(process.env.NEXT_PUBLIC_TINA_CLIENT_ID)',
     name: 'tina-cloud',
     backendAuthProviderImports: [
// Source: https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af

Detection Methods for CVE-2026-63506

Indicators of Compromise

Successful authenticated GraphQL mutations (create, update, delete) originating from IP addresses or user agents not associated with legitimate editors.
Media API activity (upload, delete, list) tied to TinaCloud user IDs that do not exist in the site's editor roster.
Bearer tokens presented to the site whose issuing clientID differs from NEXT_PUBLIC_TINA_CLIENT_ID.

Detection Strategies

Instrument isAuthorized and isUserAuthorized call sites to log the clientID used for validation and alert whenever it differs from the site's configured client identifier.
Correlate authenticated content mutations with the identity provider's user directory to flag verified users that lack a corresponding editor account.
Review web server logs for unusual POST volume against TinaCMS API routes such as /api/tina/* and Azure media authorized callback endpoints.

Monitoring Recommendations

Ingest application and reverse-proxy logs into a centralized analytics platform to baseline normal editor behavior and surface anomalies.
Track content and media object versions to detect unauthorized modifications or deletions that align with the exploitation window.
Enable audit logging inside TinaCloud and reconcile activity against expected editorial workflows.

How to Mitigate CVE-2026-63506

Immediate Actions Required

Upgrade @tinacms/auth to version 1.1.4 or later and next-tinacms-azure to version 15.0.1 or later.
Update all call sites of isAuthorized to pass the site's configured client ID, for example isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID).
Replace TinaCloudBackendAuthProvider() with TinaCloudBackendAuthProvider(process.env.NEXT_PUBLIC_TINA_CLIENT_ID) in backend configuration.
Audit recent content and media changes to identify and revert unauthorized modifications performed during the exposure window.

Patch Information

The fix is delivered in @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1. The change scopes TinaCloud authorization to the site's configured clientID as shown in GitHub Pull Request #7168 and detailed in GitHub Security Advisory GHSA-g74q-6g2f-874x.

Workarounds

If patching is not immediately possible, wrap isAuthorized in a custom handler that overrides any request-supplied clientID with the server-side environment variable before invoking TinaCloud validation.
Restrict access to TinaCMS admin, GraphQL, and media endpoints via network controls, IP allowlists, or an authenticating reverse proxy until upgrades are complete.
Temporarily disable the affected Azure media authorized callback if it is not required for production workflows.

bash

# Configuration example - ensure the backend provider is scoped to the site's client ID
export NEXT_PUBLIC_TINA_CLIENT_ID="<your-tinacloud-app-id>"

# In your backend auth configuration:
# backendAuthProvider: TinaCloudBackendAuthProvider(process.env.NEXT_PUBLIC_TINA_CLIENT_ID)

# Verify installed versions after upgrade
npm ls @tinacms/auth next-tinacms-azure