{"cve":"CVE-2026-77561","nvd":{"published":"2026-09-21T17:18:52.943","modified":"2026-09-24T23:19:02.063","status":"Deferred","description":"Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-307"],"references":["https://github.com/tinyauthapp/tinyauth/commit/654b5cc436fc67865c1f55edf9ba9fbded50b74f","https://github.com/tinyauthapp/tinyauth/commit/dade1e2c8f27a23df56ac216dcaf4b37081698e7","https://github.com/tinyauthapp/tinyauth/pull/1008","https://github.com/tinyauthapp/tinyauth/pull/943","https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-77561","score":0.006,"percentile":0.48713,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9xhm-w3wj-xhqh","url":"https://osv.dev/vulnerability/GHSA-9xhm-w3wj-xhqh","summary":"Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service","modified":"2026-10-01T20:56:00.010969924Z","packages":[{"ecosystem":"Go","name":"github.com/steveiliop56/tinyauth","purl":"pkg:golang/github.com/steveiliop56/tinyauth","ranges":["<1.0.1-0.20260715123057-dade1e2c8f27"],"fixed":["1.0.1-0.20260715123057-dade1e2c8f27"]}]},{"id":"GO-2026-6564","url":"https://osv.dev/vulnerability/GO-2026-6564","summary":"Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth","modified":"2026-10-01T20:45:14.024702594Z","packages":[{"ecosystem":"Go","name":"github.com/tinyauthapp/tinyauth","purl":"pkg:golang/github.com/tinyauthapp/tinyauth","ranges":["<1.0.1-0.20260715123057-dade1e2c8f27"],"fixed":["1.0.1-0.20260715123057-dade1e2c8f27"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}