Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-77582Tinyauth: User enumeration attack by timing oracle

Medium 6.9

In plain English

A medium-severity security flaw in tinyauth from tinyauthapp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.6%top 49.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tinyauthapp/tinyauth	1.0.1-0.20260714134959-c22925c2fba9	GHSA-456h-ww26-f758
Go	github.com/tinyauthapp/tinyauth	1.0.1-0.20260714134959-c22925c2fba9	GO-2026-6555

Affected products (as reported)

Vendor	Product	Versions
tinyauthapp	tinyauth	< 5.1.0

Weakness: CWE-208 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 x_refsource_CONFIRM
https://github.com/tinyauthapp/tinyauth/pull/1004 x_refsource_MISC
https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310 x_refsource_MISC
https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0 x_refsource_MISC