Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M
CVE-2026-77560Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
High 8.1
In plain English
A high-severity incorrect authorization in tinyauth from tinyauthapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/tinyauthapp/tinyauth | 1.0.1-0.20260720133915-80bc87188ec3 | GHSA-328g-jx67-v94g |
| Go | github.com/tinyauthapp/tinyauth | 1.0.1-0.20260720133915-80bc87188ec3 | GO-2026-6552 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tinyauthapp | tinyauth | < 5.1.2 |
Weakness: CWE-178, CWE-636, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g x_refsource_CONFIRM
- https://github.com/tinyauthapp/tinyauth/pull/1000 x_refsource_MISC
- https://github.com/tinyauthapp/tinyauth/pull/1028 x_refsource_MISC
- https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275 x_refsource_MISC
- https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399 x_refsource_MISC
- https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2 x_refsource_MISC