CVE-2026-77561

The Tinyauth authentication server is vulnerable to a denial of service (DoS) attack in versions prior to 5.1.0 . An unauthenticated remote attacker can send POST /api/user/login requests using 257 distinct nonexistent usernames to exhaust the MaxLoginAttemptRecords cap. This triggers a global lo...