Live › vulnerability › CVE-2026-77561
Go to dashboardTinyauth, a Go authentication server, lets an unauthenticated remote attacker send login requests for 257 distinct nonexistent usernames to trigger a global login lockdown. While the lockdown is active, valid users get HTTP 429 on login, so the attacker causes a denial of service against all logins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/tinyauthapp/tinyauth | go | < 1.0.1-0.20260715123057-dade1e2c8f27 | 1.0.1-0.20260715123057-dade1e2c8f27 |
Unknown from the sources.
5.1.0 per the advisory text; the listed Go pseudo-version 1.0.1-0.20260715123057-dade1e2c8f27 is the fixed version in the product data and needs confirmingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77561")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.