Description
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tinyauth | tinyauth | < 5.1.3 | 5.1.3 |
Medium · 5.4
CVE-2026-97736
EUVD-2026-86515GHSA-rp6g-vgfj-26cr
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
Published Sep 25, 2026 · Updated Sep 26, 2026 · Assigned by mitre