CVE-2026-77560 Details
Description
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.
A case sensitivity vulnerability has been identified in Tinyauth's forward-auth mechanism. Prior to version 5.1.2, Tinyauth matched forwarded hostnames in a case-sensitive manner, while reverse proxies handled them case-insensitively. This discrepancy allowed an authenticated low-privilege user to bypass application-specific access controls by using a differently cased hostname. The issue arises in the internal access control lookup process, where the absence of a match can lead to an empty access control object being returned. Consequently, the proxy handler treats this as permissive, granting access to applications that should have been restricted.
Users are advised to update Tinyauth to version 5.1.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275 | [email protected] | Source CodeVendor |
| https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399 | [email protected] | Source CodeVendor |
| https://github.com/tinyauthapp/tinyauth/pull/1000 | [email protected] | Issue TrackingVendor |
| https://github.com/tinyauthapp/tinyauth/pull/1028 | [email protected] | Issue TrackingVendor |
| https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2 | [email protected] | Release NotesVendor |
| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-636 | Not Failing Securely ('Failing Open') | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tinyauth | <= 5.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |