Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-77560 · Microsoft / collected KEV context

EUVD-2026-84011

GHSA-328g-jx67-v94g

GO-2026-6552

cve-program · CVE-2026-77560

• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g
• https://github.com/tinyauthapp/tinyauth/pull/1000
• https://github.com/tinyauthapp/tinyauth/pull/1028
• https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275
• https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2

euvd · EUVD-2026-84011

• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g
• https://github.com/tinyauthapp/tinyauth/pull/1000
• https://github.com/tinyauthapp/tinyauth/pull/1028
• https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275
• https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2

nvd · CVE-2026-77560

• https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275
• https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399
• https://github.com/tinyauthapp/tinyauth/pull/1000
• https://github.com/tinyauthapp/tinyauth/pull/1028
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2
• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g

osv · GHSA-328g-jx67-v94g

• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g
• https://nvd.nist.gov/vuln/detail/CVE-2026-77560
• https://github.com/tinyauthapp/tinyauth/pull/1000
• https://github.com/tinyauthapp/tinyauth/pull/1028
• https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275
• https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399
• https://github.com/tinyauthapp/tinyauth
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2

osv · GO-2026-6552

• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g
• https://nvd.nist.gov/vuln/detail/CVE-2026-77560
• https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275
• https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399
• https://github.com/tinyauthapp/tinyauth/pull/1000
• https://github.com/tinyauthapp/tinyauth/pull/1028
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2

No related operational record is retained in the current change model.