Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-77561Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Medium 5.3

In plain English

A medium-severity security flaw in tinyauth from tinyauthapp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/steveiliop56/tinyauth1.0.1-0.20260715123057-dade1e2c8f27GHSA-9xhm-w3wj-xhqh
Gogithub.com/tinyauthapp/tinyauth1.0.1-0.20260715123057-dade1e2c8f27GO-2026-6564

Affected products (as reported)

VendorProductVersions
tinyauthapp tinyauth < 5.1.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References