Skip to content
OpenAdvisories

Package · Go

github.com/steveiliop56/tinyauth

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-77561

    Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

    Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. inte…

    tinyauthapp tinyauth github.com/steveiliop56/tinyauth github.com/tinyauthapp/tinyauth Go
  • Medium 6.5
    CVE-2026-32245

    Tinyauth's OIDC authorization codes are not bound to client on token exchange

    Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another c…

    steveiliop56 tinyauth github.com/steveiliop56/tinyauth Go