tinyauthapp/tinyauth Security Advisories | GitStock

medium2026-09-22

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

GHSA-9xhm-w3wj-xhqh · CVE-2026-77561

high2026-09-22

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

GHSA-328g-jx67-v94g · CVE-2026-77560

medium2026-09-22

Tinyauth: User enumeration attack by timing oracle

GHSA-456h-ww26-f758 · CVE-2026-77582