CVE-2026-77582

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310
https://github.com/tinyauthapp/tinyauth/pull/1004
https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0
https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758
https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758

Configurations

No configuration.

History

23 Sep 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 -~~	() https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758 -

21 Sep 2026, 17:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 17:18

Updated : 2026-09-30 17:32

NVD link : CVE-2026-77582

Mitre link : CVE-2026-77582

CVE.ORG link : CVE-2026-77582

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-77582", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77582", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T19:16:31.589447Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tinyauthapp", "product": "tinyauth", "versions": [{"status": "affected", "version": "< 5.1.0"}]}]}], "published": "2026-09-21T17:18:53.110", "references": [{"url": "https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310", "source": "security-advisories@github.com"}, {"url": "https://github.com/tinyauthapp/tinyauth/pull/1004", "source": "security-advisories@github.com"}, {"url": "https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758", "source": "security-advisories@github.com"}, {"url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0."}], "lastModified": "2026-09-30T17:32:07.107", "sourceIdentifier": "security-advisories@github.com"}