CVE-2026-77560
Received Received - Intake

Tinyauth Hostname Case-Sensitive Access Control Bypass

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-77560
EUVD
EUVD-2026-84011

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tinyauth tinyauth 5.1.2
tinyauth tinyauth to 5.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tinyauth is an authentication service that controls access to applications via reverse proxies. The vulnerability occurs because Tinyauth compares hostnames in a case-sensitive way while DNS and HTTP treat them as case-insensitive. An attacker can bypass access controls by changing the case of the hostname (e.g., IMMICH.example.com instead of immich.example.com). This causes Tinyauth to fail matching the correct access control list, returning an empty configuration that grants unauthorized access to restricted apps.

Detection Guidance

Check TinyAuth version with 'tinyauth --version' or 'docker inspect <container> | grep version'. If version is below 5.1.2, the system is vulnerable. Monitor logs for access control bypass attempts by looking for case variations in hostnames like 'IMMICH.example.com' vs 'immich.example.com'.

Impact Analysis

If you use Tinyauth to restrict access to applications, an authenticated user could bypass those restrictions by altering the case of the hostname. This allows unauthorized access to apps that should be restricted based on user, group, IP, or other controls. The attacker only needs a valid account to exploit this issue.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (e.g., unauthorized data access under Article 32) and HIPAA (e.g., impermissible access under the Security Rule). Organizations using TinyAuth for access control must ensure proper access restrictions to meet regulatory standards.

Mitigation Strategies

Upgrade TinyAuth to version 5.1.2 or later immediately. Update Docker images and Kubernetes deployments to the patched version. Review access control logs for unauthorized access attempts and adjust ACL configurations to enforce case-insensitive hostname matching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart