Unauthenticated Login Lockdown Vulnerability in Tinyauth Authentication Server

CVE-2026-77561

What is CVE-2026-77561?

The Tinyauth authentication and authorization server is susceptible to a vulnerability that allows unauthorized attackers to exploit the login mechanism. Prior to version 5.1.0, an attacker can send multiple POST /api/user/login requests using nonexistent usernames, triggering a global login lockdown. This results in valid users being denied access with repeated HTTP 429 responses, effectively locking them out for approximately 5 minutes due to the influx of invalid login attempts. Although the incident can be repeated, it does not invalidate existing authenticated sessions. The issue was addressed in version 5.1.0, which includes necessary updates to mitigate this attack vector.

References