CVE-2026-77561
Received Received - Intake

Authentication Bypass via Login Lockdown in Tinyauth

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-77561
EUVD
EUVD-2026-84015

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tinyauthapp tinyauth 5.1.0
tinyauthapp tinyauth to 5.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tinyauth before version 5.1.0 has a vulnerability where an unauthenticated attacker can send 257 distinct fake usernames to trigger a global login lockdown. This causes the system to lock all accounts until a timeout expires, preventing valid users from logging in for about 5 minutes by default.

Detection Guidance

Monitor for repeated failed login attempts from multiple sources. Check logs for HTTP 429 responses or account lockouts affecting valid users. Use network traffic analysis to detect 257 distinct nonexistent usernames in POST /api/user/login requests.

Impact Analysis

This vulnerability allows attackers to perform a denial-of-service attack, blocking legitimate users from accessing the system for up to 5 minutes. Existing sessions remain unaffected, but new logins are prevented during the lockdown period.

Compliance Impact

This vulnerability primarily impacts availability by causing a global login lockdown, preventing legitimate users from accessing the system for approximately 300 seconds by default. While it does not directly expose or leak data, it could disrupt access to systems handling sensitive data, potentially violating availability requirements in GDPR (Article 32) and HIPAA (45 CFR § 164.312(a)(2)(ii)). The denial-of-service effect may interfere with timely access to protected health information or personal data, though no direct data breach is indicated.

Mitigation Strategies

Upgrade to Tinyauth version 5.1.0 or later to remove the global lockdown mechanism. Implement rate limiting by client IP and normalized username. Configure bounded LRU eviction for login-attempt records to prevent unbounded memory growth.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart