CVE-2026-77582
Received Received - Intake

Timing Attack in Tinyauth Authentication

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-77582
EUVD
EUVD-2026-84014

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tinyauthapp tinyauth 5.1.0
tinyauthapp tinyauth to 5.1.0 (exc)
tinyauthapp tinyauth to 5.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77582 is a timing oracle vulnerability in Tinyauth versions before 5.1.0. It allows attackers to determine if a username exists by measuring response times during login attempts. Existing users trigger slow bcrypt password checks while non-existent users return quickly, creating a timing difference that can be exploited for user enumeration and targeted credential attacks.

Detection Guidance

This vulnerability can be detected by measuring response times during authentication attempts. Existing users with incorrect passwords will show significantly longer response times (~50ms) compared to non-existent users (~50 microseconds). Use tools like curl or custom scripts to repeatedly query the login endpoint and compare response times for different usernames.

Impact Analysis

This vulnerability enables attackers to identify valid usernames in your system through timing analysis. Once valid usernames are known, attackers can perform targeted brute-force or credential stuffing attacks against those accounts, potentially gaining unauthorized access to sensitive data or system functions.

Compliance Impact

This vulnerability compromises data confidentiality by allowing unauthorized username enumeration, which violates GDPR's data protection principles and HIPAA's safeguards for protected health information. It creates compliance risks by exposing personal data to potential breaches through targeted attacks on valid accounts.

Mitigation Strategies

Upgrade Tinyauth to version 5.1.0 or later to apply the timing-attack fix. If upgrading is not immediately possible, implement constant-time comparison for user checks in the authentication flow. Ensure all authentication-related operations follow a uniform process to prevent timing side channels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart