{"id":"EUVD-2026-84014","enisaUuid":"bdb6a01b-c5f2-30bb-bf78-64751ec87eaf","description":"Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.","datePublished":"Sep 21, 2026, 4:43:43 PM","dateUpdated":"Sep 23, 2026, 7:16:39 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758\nhttps://github.com/tinyauthapp/tinyauth/pull/1004\nhttps://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310\nhttps://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0\n","aliases":"CVE-2026-77582\nGHSA-456h-ww26-f758\n","assigner":"GitHub_M","epss":0.63,"enisaIdProduct":[{"id":"2eeee5d8-aa4a-30e1-a0dc-8d145ca04525","product":{"name":"tinyauth","vendor":{"name":"steveiliop56"}},"product_version":"\u003c 5.1.0"}],"enisaIdVendor":[{"id":"ff574253-c121-3159-b506-2b1eac5e8733","vendor":{"name":"tinyauthapp"}}],"enisaIdVulnerability":[{"id":"87c12a67-55ed-344b-941f-1bca080d4c51","vulnerability":{"id":"GHSA-456h-ww26-f758","description":"Tinyauth: User enumeration attack by timing oracle","datePublished":"Sep 22, 2026, 8:37:06 PM","dateUpdated":"Sep 22, 2026, 8:37:06 PM","baseScore":0.0,"references":"https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77582\nhttps://github.com/tinyauthapp/tinyauth/pull/1004\nhttps://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310\nhttps://github.com/tinyauthapp/tinyauth\nhttps://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0\n","enisa_id":"EUVD-2026-84014\n","aliases":"GHSA-456h-ww26-f758\nCVE-2026-77582\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cab93819-63c2-3ce4-a161-d47f893a0ee8","vulnerability":{"id":"CVE-2026-77582","description":"Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.","datePublished":"Sep 21, 2026, 4:43:43 PM","dateUpdated":"Sep 23, 2026, 7:16:39 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758\nhttps://github.com/tinyauthapp/tinyauth/pull/1004\nhttps://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310\nhttps://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0\n","enisa_id":"EUVD-2026-84014\n","assigner":"GitHub_M","epss":0.63,"dataProcessed":"Oct 30, 2026, 7:15:53 AM","vulnerabilityProduct":[{"id":"3a1d993f-3802-386a-b4c9-d82282574893","product":{"name":"tinyauth","vendor":{"name":"steveiliop56"}},"product_version":"\u003c 5.1.0"}],"vulnerabilityVendor":[{"id":"a384e8eb-16e1-3c4c-851f-0ea03e2cb085","vendor":{"name":"tinyauthapp"}}]}}],"enisaIdAdvisory":[]}