CVE-2026-77582: falha de média gravidade em tinyauthapp tinyauth
Tinyauth: User enumeration attack by timing oracle
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.6%
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
tinyauthapp · tinyauthCVEs relacionadas — tinyauthapp tinyauth
No mesmo produto, das mais perigosas para as menos.
CVE-2026-77560HIGHTinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist forEPSS 0.6%CVE-2026-77561MEDIUMTinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceEPSS 0.6%