{"id":"CVE-2026-77561","kind":"vulnerability","aliases":["CVE-2026-77561","GHSA-9xhm-w3wj-xhqh","GO-2026-6564"],"related":[],"title":"Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth","description":"Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.","summary":"Tinyauth, a Go authentication server, lets an unauthenticated remote attacker send login requests for 257 distinct nonexistent usernames to trigger a global login lockdown. While the lockdown is active, valid users get HTTP 429 on login, so the attacker causes a denial of service against all logins.","severity":"medium","cvss":5.3,"epss":0.006,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/tinyauthapp/tinyauth","fixed":["1.0.1-0.20260715123057-dade1e2c8f27"],"affected":"< 1.0.1-0.20260715123057-dade1e2c8f27","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","tinyauth"],"not_affected_if":[],"how_to_check":null,"fix":"Upgrade github.com/tinyauthapp/tinyauth to 5.1.0 per the advisory text; the listed Go pseudo-version 1.0.1-0.20260715123057-dade1e2c8f27 is the fixed version in the product data and needs confirming.\nExisting authenticated sessions are not invalidated by the attack, so no token rotation is indicated by the sources.","status":"open","published_at":"2026-09-21T17:18:52+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:00+00:00","updated_at":"2026-10-23T21:49:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:49:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/tinyauthapp/tinyauth to 5.1.0 per the advisory text; the listed Go pseudo-version 1.0.1-0.20260715123057-dade1e2c8f27 is the fixed version in the product data and needs confirming.\nExisting authenticated sessions are not invalidated by the attack, so no token rotation is indicated by the sources.","reach":"internet","impact":"medium","summary":"Tinyauth, a Go authentication server, lets an unauthenticated remote attacker send login requests for 257 distinct nonexistent usernames to trigger a global login lockdown. While the lockdown is active, valid users get HTTP 429 on login, so the attacker causes a denial of service against all logins.","category":"package","who_cares":["go","self-hosted","tinyauth"],"confidence":0.7,"needs_auth":"no","worst_case":"Valid users locked out of login for minutes, repeatable by attacker","analyst_note":"Sources conflict on the fixed version: the description says 5.1.0 but govuln lists the pseudo-version 1.0.1-0.20260715123057-dade1e2c8f27; confirm at https://pkg.go.dev/vuln/GO-2026-6564 and https://nvd.nist.gov/vuln/detail/CVE-2026-77561, and find how to check exposure (version or auth.loginTimeout setting).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001111,"input_tokens":3147,"output_tokens":1593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A,29A '-6564':27A '-77561':19A,30A '/api/user/login':104C '/tinyauthapp/tinyauth':16A,33A '257':54B,107C '300':160C '429':73B,155C '5.1.0':96C,182C '9xhm':22A 'account':148C 'activ':68B,115C 'approxim':159C 'attack':49B,78B,100C,125C,165C 'attacker-control':124C 'attempt':4A 'auth.logintimeout':157C 'authent':43B,90C,171C 'author':92C 'cap':139C 'caus':79B,149C 'check':141C 'control':126C 'cve':17A,28A 'default':163C 'denial':10A,81B 'distinct':55B,108C 'exist':170C 'expir':158C 'fill':112C 'fix':179C 'get':71B 'ghsa':21A 'ghsa-9xhm-w3wj-xhqh':20A 'github.com':15A,32A 'github.com/tinyauthapp/tinyauth':14A,31A 'global':7A,61B,117C,143C 'go':25A,34B,42B 'host':38B 'http':72B,154C 'identifi':127C 'internal/controller/user_controller.go':120C 'internal/service/auth_service.go':129C 'invalid':175C 'invok':132C 'isaccountlock':140C 'issu':177C 'let':45B 'lockdown':9A,63B,66B,119C 'lockdownmod':133C 'login':3A,8A,51B,62B,75B,86B,118C 'loginhandl':121C 'map':136C 'maxloginattemptrecord':113C 'nonexist':56B,109C 'packag':35B 'pass':122C 'post':103C 'prior':94C 'reach':137C 'receiv':153C 'recordloginattempt':130C 'remot':48B,99C 'repeat':168C 'request':52B,105C 'second':161C 'self':37B 'self-host':36B 'send':50B,102C 'server':44B,93C 'servic':12A,83B 'session':172C 'state':144C 'tinyauth':1A,39B,40B,87C 'trigger':6A,59B 'unauthent':2A,47B,98C 'unrel':147C 'user':70B,151C 'usernam':57B,110C 'valid':69B,146C,150C 'version':181C 'w3wj':23A 'xhqh':24A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T17:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6564","url":"https://pkg.go.dev/vuln/GO-2026-6564","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77561","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77561","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77561","severity":null,"published_at":"2026-09-21T17:18:52+00:00","modified_at":"2026-09-24T23:19:02+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}