CVE-2026-97736
MediumCVSS 5.4Summary
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
Risk Assessment
An attacker can access protected routes by appending a known allowed string, leading to bypass of authorization mechanisms.
Recommendation
Update tinyauth to version 5.1.3 or later, which fixes the anchoring of regular expressions in rules.
Other vulnerabilities in tinyauth
See all- CVE-2026-77582Medium
Tinyauth prior to 5.1.0 exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. The loginHandler and basicAuth functions return quickly after a missing user is reported, while an existing user causes bcrypt password verification work.
- CVE-2026-77561Medium
Tinyauth prior to 5.1.0 allows an unauthenticated remote attacker to send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 for approximately 300 seconds.
- CVE-2026-77560High
In Tinyauth prior to 5.1.2, forwarded hostnames are compared case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup can miss the configured app and return an empty access-control object, which is then treated as permissive.
Original NVD description (English source)
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS