CVE-2026-77561

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-77561

The Tinyauth authentication server is vulnerable to a denial of service (DoS) attack in versions prior to 5.1.0 . An unauthenticated remote attacker can send POST /api/user/login requests using 257 distinct nonexistent usernames to exhaust the MaxLoginAttemptRecords cap. This triggers a global lo...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...