CVE-2026-77582 Details
Description
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
A user enumeration vulnerability has been identified in Tinyauth versions prior to 5.1.0. This issue arises from a timing oracle that allows for the remote observation of authentication attempt durations, creating a discrepancy between existing and non-existing usernames. When an authentication attempt is made for a non-existent username, the response is significantly faster compared to an existing username, which incurs a delay due to password verification. This timing difference can be exploited to identify valid usernames and facilitate targeted credential attacks.
Users are advised to update Tinyauth to version 5.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310 | [email protected] | Source CodeVendor |
| https://github.com/tinyauthapp/tinyauth/pull/1004 | [email protected] | Source CodeVendor |
| https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0 | [email protected] | Release NotesVendor |
| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tinyauth | <= 5.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |