CVE-2026-77582
Severity not reportedTinyauth is an authentication and authorization server.
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310 security-advisories@github.com
- https://github.com/tinyauthapp/tinyauth/pull/1004 security-advisories@github.com
- https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0 security-advisories@github.com
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 security-advisories@github.com
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 134c704f-9b21-4f2e-91b3-4a467353bcc0