Authentication and Authorization Vulnerability in Tinyauth Server

CVE-2026-77582

What is CVE-2026-77582?

The Tinyauth authentication and authorization server prior to version 5.1.0 is impacted by a vulnerability that exposes a timing discrepancy between login attempts for valid and invalid usernames. When a non-existent username is provided, the system responds swiftly, while authenticating a valid username incurs a significant delay due to bcrypt password verification. This behavior allows attackers to conduct timing attacks, effectively revealing valid usernames through repeated login attempts, thus increasing the risk of targeted credential attacks. The issue has been addressed in version 5.1.0.

References