CVE-2026-77582
MediumCVSS 6.9Summary
Tinyauth prior to 5.1.0 exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. The loginHandler and basicAuth functions return quickly after a missing user is reported, while an existing user causes bcrypt password verification work.
Risk Assessment
Repeated measurements can disclose valid usernames and support targeted credential attacks. The risk affects the confidentiality of account names and authentication security.
Recommendation
Update Tinyauth to version 5.1.0 or later, which fixes the timing difference. Consider additional login attempt throttling and monitoring for unusual patterns.
Other vulnerabilities in Tinyauth
See all- CVE-2026-77561Medium
Tinyauth prior to 5.1.0 allows an unauthenticated remote attacker to send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 for approximately 300 seconds.
- CVE-2026-77560High
In Tinyauth prior to 5.1.2, forwarded hostnames are compared case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup can miss the configured app and return an empty access-control object, which is then treated as permissive.
Original NVD description (English source)
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.