Tinyauthapp Tinyauth vulnerabilities

CVE-2026-77560 [HIGH] CWE-178 CVE-2026-77560: Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_contro

CVE-2026-77582 [MEDIUM] CWE-208 CVE-2026-77582: Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service

CVE-2026-77561 [MEDIUM] CWE-307 CVE-2026-77561: Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote at Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier t