{"id":"CVE-2026-97736","title":"tinyauth before 5.1.3 allows rule bypass by appending an allowed route string","summary":"tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-777"],"vendor":"tinyauth","product":"github.com/tinyauthapp/tinyauth","affected":["github.com/tinyauthapp/tinyauth < 5.1.3"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T04:17:50.977","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97736","references":[{"url":"https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T04:59:31.583Z","slug":"CVE-2026-97736","body":"## Overview\n\ntinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}