Skip to content
OpenAdvisories

Package · Go

github.com/tinyauthapp/tinyauth

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2026-77561

    Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

    Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. inte…

    tinyauthapp tinyauth github.com/steveiliop56/tinyauth github.com/tinyauthapp/tinyauth Go
  • Medium 6.9
    CVE-2026-77582

    Tinyauth: User enumeration attack by timing oracle

    Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler …

    tinyauthapp tinyauth github.com/tinyauthapp/tinyauth Go
  • High 8.1
    CVE-2026-77560

    Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

    Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app …

    tinyauthapp tinyauth github.com/tinyauthapp/tinyauth Go