CVE-2026-77582

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0

Description Tinyauth exposes a timing difference during authentication attempts that allows a remote observer to distinguish between existing and nonexistent local usernames. This occurs because the loginHandler function in internal/controller/user controller.go and the basicAuth function in internal/middleware/context middleware.go return responses quickly when the auth service.go reports a missing user, whereas existing users trigger bcrypt password verification, which takes more time. Repeated measurements of these response times can disclose valid usernames, facilitating targeted credential attacks.

Recommendations Update to version 5.1.0.