Authentication Bypass Vulnerability in Tinyauth by Tinyauthapp

CVE-2026-77560

What is CVE-2026-77560?

Tinyauth, an authentication and authorization server, contains a vulnerability that allows an authenticated low-privilege user to bypass per-application access controls by using differently cased hostnames. This issue arises as Tinyauth compares forwarded hostnames in a case-sensitive manner, while reverse proxies route equivalent hostnames without case sensitivity. As a result, if hosted under a reverse proxy, a user with legitimate access can manipulate the hostname casing to circumvent controls intended to secure specific app access. The affected code paths can return empty access control objects, leading the system to erroneously grant access. This vulnerability was addressed in version 5.1.2 of Tinyauth.

References