tinyauthapp tinyauth vulnerabilities

Latest tinyauthapp tinyauth CVEs

Newest publication first

1. CVE-2026-97736 tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

   Published 2026-09-25

   Medium·CVSS 5.4

   tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

2. CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

   Published 2026-09-21

   Medium·CVSS 5.3

   Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_...

3. CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle

   Published 2026-09-21

   Medium·CVSS 6.9

   Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middlewa...

4. CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

   Published 2026-09-21

   High·CVSS 8.1

   Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.