CVE-2026-77582: Tinyauth: User enumeration attack by timing oracle
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and internal/middleware/contextmiddleware.go basicAuth return quickly after internal/service/authservice.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tinyauthto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker who can submit authentication attempts can repeatedly measure response times to distinguish existing local usernames from nonexistent ones. The disclosed usernames can then support targeted credential attacks.
Are both login and HTTP Basic Authentication affected?
Yes. The timing difference is present in the login handler and in the Basic Authentication middleware when local usernames are checked.
Which versions are affected and what fixes it?
Versions prior to 5.1.0 are affected. Upgrade to Tinyauth 5.1.0 to obtain the fix.