tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

{
                    "collectionURL": "https://proxy.golang.org",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "forward-auth per-app path ACL"
                    ],
                    "packageName": "github.com/tinyauthapp/tinyauth",
                    "product": "tinyauth",
                    "programFiles": [
                        "internal/service/access_controls_rules.go"
                    ],
                    "repo": "https://github.com/tinyauthapp/tinyauth",
                    "vendor": "tinyauth",
                    "versions": [
                        {
                            "lessThan": "5.1.3",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }