{"id":"CVE-2026-77582","kind":"vulnerability","aliases":["CVE-2026-77582","GHSA-456h-ww26-f758","GO-2026-6555"],"related":[],"title":"Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth","description":"Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.","summary":"Tinyauth's login and basic-auth paths respond measurably faster for nonexistent usernames than for existing ones, because bcrypt password checking only runs for real accounts. A remote attacker can time repeated login attempts to discover valid usernames and then target them with password guessing.","severity":"medium","cvss":6.9,"epss":0.00481,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/tinyauthapp/tinyauth","fixed":["1.0.1-0.20260714134959-c22925c2fba9"],"affected":"< 1.0.1-0.20260714134959-c22925c2fba9","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","tinyauth"],"not_affected_if":[],"how_to_check":"Check the tinyauth version in go.mod: go list -m github.com/tinyauthapp/tinyauth\nAffected if older than 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or older than 5.1.0 (description).","fix":"Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or 5.1.0 (description); the sources disagree on the fixed version.","status":"open","published_at":"2026-09-21T17:18:53+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:00+00:00","updated_at":"2026-10-23T21:46:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:46:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or 5.1.0 (description); the sources disagree on the fixed version.","reach":"internet","impact":"low","summary":"Tinyauth's login and basic-auth paths respond measurably faster for nonexistent usernames than for existing ones, because bcrypt password checking only runs for real accounts. A remote attacker can time repeated login attempts to discover valid usernames and then target them with password guessing.","category":"package","who_cares":["tinyauth","self-hosted","go"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker learns valid usernames, enabling targeted password guessing attacks.","analyst_note":"Sources conflict on the fixed version: govuln says 1.0.1-0.20260714134959-c22925c2fba9, the description says 5.1.0; confirm at https://pkg.go.dev/vuln/GO-2026-6555.","how_to_check":"Check the tinyauth version in go.mod: go list -m github.com/tinyauthapp/tinyauth\nAffected if older than 1.0.1-0.20260714134959-c22925c2fba9 (govuln) or older than 5.1.0 (description).\nunknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000878,"input_tokens":3046,"output_tokens":1147,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A,24A '-6555':22A '-77582':14A,25A '/tinyauthapp/tinyauth':11A,28A '456h':17A '5.1.0':90C,147C 'account':61B 'attack':4A,64B,140C 'attempt':69B,100C 'auth':41B 'authent':84C,99C 'author':86C 'basic':40B 'basic-auth':39B 'basicauth':111C 'bcrypt':54B,125C 'caus':124C 'check':56B 'credenti':139C 'cve':12A,23A 'differ':97C 'disclos':133C 'discov':71B 'enumer':3A 'exist':51B,102C,122C 'expos':92C 'f758':19A 'faster':45B 'fix':144C 'ghsa':16A 'ghsa-456h-ww26-f758':15A 'github.com':10A,27A 'github.com/tinyauthapp/tinyauth':9A,26A 'go':20A,29B 'guess':80B 'host':33B 'internal/controller/user_controller.go':107C 'internal/middleware/context_middleware.go':110C 'internal/service/auth_service.go':115C 'issu':142C 'local':105C 'login':37B,68B 'loginhandl':108C 'measur':44B,130C 'miss':118C 'nonexist':47B,104C 'observ':95C 'one':52B 'oracl':7A 'packag':30B 'password':55B,79B,126C 'path':42B 'prior':88C 'quick':113C 'real':60B 'remot':63B,94C 'repeat':67B,129C 'report':116C 'respond':43B 'return':112C 'run':58B 'self':32B 'self-host':31B 'server':87C 'support':137C 'target':76B,138C 'therefor':132C 'time':6A,66B,96C 'tinyauth':1A,34B,35B,81C,91C 'user':2A,119C,123C 'usernam':48B,73B,106C,135C 'valid':72B,134C 'verif':127C 'version':146C 'work':128C 'ww26':18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T17:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6555","url":"https://pkg.go.dev/vuln/GO-2026-6555","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77582","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77582","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77582","severity":null,"published_at":"2026-09-21T17:18:53+00:00","modified_at":"2026-09-30T17:32:07+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}