Live › vulnerability › CVE-2026-77582
Go to dashboardTinyauth's login and basic-auth paths respond measurably faster for nonexistent usernames than for existing ones, because bcrypt password checking only runs for real accounts. A remote attacker can time repeated login attempts to discover valid usernames and then target them with password guessing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/tinyauthapp/tinyauth | go | < 1.0.1-0.20260714134959-c22925c2fba9 | 1.0.1-0.20260714134959-c22925c2fba9 |
Check the tinyauth version in go.mod: go list -m github.com/tinyauthapp/tinyauth
Affected if older than 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or older than 5.1.0 (description).
Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or 5.1.0 (description); the sources disagree on the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77582")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.