CVE-2026-97736 Details
Description
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
An authentication bypass vulnerability has been identified in tinyauth versions prior to 5.1.3. The issue arises in the forward-auth feature, where path allow/block rules are applied as unanchored regular expressions to the entire request URI, including the query string. This allows an attacker to append an allowed path string to a query parameter and access protected routes without authentication. The vulnerability is present in the 'internal/controller/proxy_controller.go' and 'internal/service/access_controls_rules.go' files.
Users can update to tinyauth version 5.1.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-777 | Regular Expression without Anchors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tinyauthapp tinyauth | <= 5.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |