Skip to content
OpenAdvisories

Product · tinyauthapp

tinyauth

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-77561

    Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

    Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. inte…

    tinyauthapp tinyauth github.com/steveiliop56/tinyauth github.com/tinyauthapp/tinyauth Go
  • Medium 6.9
    CVE-2026-77582

    Tinyauth: User enumeration attack by timing oracle

    Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler …

    tinyauthapp tinyauth github.com/tinyauthapp/tinyauth Go