CVE-2026-77582

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77582
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77582.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77582
Aliases
Published
2026-09-21T16:43:43Z
Modified
2026-09-25T03:30:58Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Tinyauth: User enumeration attack by timing oracle
Details

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-208"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77582.json"
}
References

Affected packages

Git / github.com/tinyauthapp/tinyauth

Affected ranges

Type
GIT
Repo
https://github.com/tinyauthapp/tinyauth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c22925c2fba981875d0a2b09dd3ee41c0ae4c310
Fixed
9eabfe89fdecc030c33054eaad6c998bf55661fb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
nightly
v0.*
v0.1.0
v0.1.0-beta.1
v0.2.0
v0.2.0-beta.1
v0.3.0
v0.3.0-beta.1
v0.3.0-beta.2
v0.3.0-beta.3
v1.*
v1.0.0
v1.0.0-alpha.1
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-beta.1
v2.0.1
v2.0.2
v2.0.2-beta.1
v2.0.2-beta.2
v2.1.0
v2.1.0-alpha.1
v2.1.0-alpha.2
v2.1.1
v2.1.1-beta.1
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.1
v3.0.1-beta.1
v3.1.0
v3.1.0-alpha.1
v3.1.0-beta.1
v3.1.0-beta.2
v3.1.0-exp.1
v3.1.0-exp.2
v3.1.0-exp.3
v3.2.0
v3.2.0-alpha.1
v3.2.0-beta.1
v3.2.0-beta.2
v3.2.0-beta.3
v3.2.0-beta.4
v3.2.0-beta.5
v3.2.0-beta.6
v3.2.1
v3.2.1-beta.1
v3.3.0
v3.3.0-alpha.1
v3.3.0-alpha.2
v3.3.0-alpha.3
v3.3.1
v3.3.1-beta.1
v3.4.0
v3.4.0-alpha.1
v3.4.0-beta.1
v3.4.0-beta.2
v3.4.1
v3.4.1-beta.1
v3.5.0
v3.5.0-alpha.1
v3.5.0-alpha.2
v3.6.0
v3.6.0-beta.1
v3.6.0-beta.2
v3.6.1
v3.6.1-beta.1
v3.6.1-beta.2
v3.6.1-beta.3
v3.6.2
v3.6.2-beta.1
v3.6.2-beta.2
v3.6.2-beta.3
v3.6.2-beta.4
v4.*
v4.0.0
v4.0.0-alpha.1
v4.0.0-alpha.2
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-rc.1
v4.0.1
v4.0.1-beta.1
v4.0.1-beta.2
v4.1.0
v4.1.0-beta.1
v4.1.0-rc.1
v4.1.0-rc.2
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0-alpha.3
v5.0.0-alpha.4
v5.0.0-alpha.5
v5.0.0-beta.1
v5.0.0-beta.2
v5.0.0-beta.3
v5.0.0-beta.4
v5.0.0-rc.1
v5.0.0-rc.2
v5.0.1
v5.0.1-beta.1
v5.0.1-rc.1
v5.0.2
v5.0.2-beta.1
v5.0.2-beta.2
v5.0.3
v5.0.3-beta.1
v5.0.4
v5.0.5
v5.0.5-beta.1
v5.0.5-beta.2
v5.0.5-beta.3
v5.0.5-rc.1
v5.0.5-rc.2
v5.0.6
v5.0.6-beta.1
v5.0.7
v5.0.7-alpha.1
v5.0.7-beta.1
v5.1.0-alpha.1
v5.1.0-alpha.2
v5.1.0-alpha.3
v5.1.0-alpha.4
v5.1.0-beta.1
v5.1.0-beta.2
v5.1.0-beta.3
v5.1.0-beta.4
v5.1.0-beta.5
v5.1.0-rc.1
v5.1.0-rc.2
v5.1.0-rc.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77582.json"