Skip to content
OpenAdvisories

Vendor

tinyauthapp

3 known vulnerabilities.

Products

tinyauth 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-77560

    Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

    Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app …

    tinyauthapp tinyauth github.com/tinyauthapp/tinyauth Go