CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle
Attackers can enumerate valid usernames via timing differences, facilitating targeted credential attacks against Tinyauth authentication server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77582?
CVE-2026-77582 is a medium-severity vulnerability in tinyauthapp tinyauth, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
Weakness: CWE-208
Which versions are affected by CVE-2026-77582?
3 open source packages ship an affected version, including github.com/tinyauthapp/tinyauth.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tinyauthapp/tinyauth Go | All versions | 1.0.1-0.20260714134959-c22925c2fba9 |
github.com/tinyauthapp/tinyauth Go | All versions | 1.0.1-0.20260714134959-c22925c2fba9 |
github.com/tinyauthapp/tinyauth Go | All versions | 1.0.1-0.20260714134959-c22925c2fba9 |
How do I fix CVE-2026-77582?
Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260714134959-c22925c2fba9 or later.
Is CVE-2026-77582 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77582 exists.
Sources
Also known as GHSA-456h-ww26-f758, GO-2026-6555.