What’s Vulnerable › Vulnerabilities

CVE-2026-77582: Tinyauth: User enumeration attack by timing oracle

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-09-30
• Weakness: CWE-208

Description

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

Affected products

• tinyauthapp tinyauth: before 5.1.0

References

• https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310
• https://github.com/tinyauthapp/tinyauth/pull/1004
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0
• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758
• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758

Get alerted when CVE-2026-77582 or the next vulnerability affects your stack