---
id: "CVE-2026-77561"
kind: "vulnerability"
aliases: ["CVE-2026-77561", "GHSA-9xhm-w3wj-xhqh", "GO-2026-6564"]
title: "Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth"
severity: "medium"
cvss: 5.3
epss: 0.006
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/tinyauthapp/tinyauth", "fixed": ["1.0.1-0.20260715123057-dade1e2c8f27"], "affected": "< 1.0.1-0.20260715123057-dade1e2c8f27", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "self-hosted", "tinyauth"]
not_affected_if: []
published_at: "2026-09-21T17:18:52+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:00+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6564", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77561", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77561", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth

Tinyauth, a Go authentication server, lets an unauthenticated remote attacker send login requests for 257 distinct nonexistent usernames to trigger a global login lockdown. While the lockdown is active, valid users get HTTP 429 on login, so the attacker causes a denial of service against all logins.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/tinyauthapp/tinyauth affected < 1.0.1-0.20260715123057-dade1e2c8f27 fixed 1.0.1-0.20260715123057-dade1e2c8f27

## Fix

Upgrade github.com/tinyauthapp/tinyauth to 5.1.0 per the advisory text; the listed Go pseudo-version 1.0.1-0.20260715123057-dade1e2c8f27 is the fixed version in the product data and needs confirming.
Existing authenticated sessions are not invalidated by the attack, so no token rotation is indicated by the sources.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6564
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77561
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77561

## From the sources

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_