GO-2026-6555 Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth

Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth...

GO-2026-6564 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...

GO-2026-6552 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth...

PT-2026-105584

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...

PT-2026-105576

Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth...

PT-2026-105573

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth...

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

CVE-2026-97736

The tinyauth application, prior to version 5.1.3 , is vulnerable to a rule bypass flaw. An attacker can bypass security rules by appending an allowed route string, which is made possible by an unanchored regular expression . No specific exploit details or remediation steps are provided in the doc...

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

EUVD-2026-86515

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

CVE-2026-97736

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

PT-2026-98351

Name of the Vulnerable Software and Affected Versions tinyauth versions prior to 5.1.3 Description A rule bypass is possible by appending an allowed route string. This issue stems from the use of an unanchored regular expression, which allows the system to match patterns regardless of their...

CVE-2026-97736: Regular Expression without Anchors

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression...

CVE-2026-77560

creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:25+00:00| published-proof-of-concept| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g 2026-10-14 21:50:15+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mxujpci2sc2m 2026-10-14...

EUVD-2026-84015

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service...

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

GHSA-9XHM-W3WJ-XHQH Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

GHSA-328G-JX67-V94G Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...