Read the docs
TI-2026-54079 Aliases CVE-2026-77560GHSA-328g-jx67-v94g

Incorrect authorization in tinyauthapp tinyauth

Priority LOW 38CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Fix Fixed tinyauth (tinyauthapp): 5.1.2github.com/tinyauthapp/tinyauth (Go): 1.0.1-0.20260720133915-80bc87188ec3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyauthapptinyauthbefore 5.1.25.1.2Patch availableCNA
—github.com/tinyauthapp/tinyauth (Go)before 1.0.1-0.20260720133915-80bc87188ec31.0.1-0.20260720133915-80bc87188ec3Patch availableGHSA-328g-jx67-v94g
  • tinyauth Vendortinyauthapp Affected before 5.1.2 Fixed in 5.1.2 Patch available CNA
  • github.com/tinyauthapp/tinyauth (Go) Vendor— Affected before 1.0.1-0.20260720133915-80bc87188ec3 Fixed in 1.0.1-0.20260720133915-80bc87188ec3 Patch available GHSA-328g-jx67-v94g

Remediation

  • Fix · CNA tinyauth (tinyauthapp) Fixed in 5.1.2
  • Fix · GHSA-328g-jx67-v94g github.com/tinyauthapp/tinyauth (Go) Fixed in 1.0.1-0.20260720133915-80bc87188ec3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77560
  2. 2026-10-03 Alias added: GHSA-328g-jx67-v94g

References

Advisory 1

Other 7

  • TI-2026-54084 Tinyauth: User enumeration attack by timing oracle CVSS 4.0MEDIUM 6.9
  • TI-2026-54080 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences