tinyauthapp has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 6.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
tinyauthapp vulnerabilities
CVEs affecting tinyauthapp, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-77561Medium· 5.3Tinyauth is an authentication and authorization server
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a globa…
CVE-2026-77582Medium· 6.9Tinyauth is an authentication and authorization server
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_contr…
CVE-2026-77560High· 8.1Tinyauth is an authentication and authorization server
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege u…