Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

GHSA-9XHM-W3WJ-XHQH Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

PT-2026-96162

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description An unauthenticated remote attacker can trigger a global login lockdown by sending POST requests to the '/api/user/login' endpoint using 257 distinct nonexistent usernames. This occurs because the...

CVE-2026-77561: Improper Restriction of Excessive Authentication Attempts

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...