CVE-2026-77561 Details

A denial-of-service vulnerability has been identified in Tinyauth, an authentication and authorization server, in versions prior to 5.1.0. The issue allows an unauthenticated remote attacker to disrupt the login process for valid users by exploiting the application's handling of login attempts. When the login endpoint receives requests with non-existent usernames, these are recorded as failed attempts. Once 257 unique invalid usernames are submitted, the application enters a global lockdown mode, temporarily locking out unrelated valid users. This lockdown lasts for approximately 300 seconds by default, during which affected users receive rate-limit responses even when providing correct credentials.

Users can update to Tinyauth version 5.1.0, which includes a fix for this vulnerability by removing the global lockdown mode and reworking the login rate-limiting logic.