CVE-2026-97736: Medium severity Tinyauth vulnerability

Q: What conditions are required for exploitation?

The issue is remotely reachable and does not require authentication or user interaction, but successful exploitation depends on an attacker being able to craft a route that appends an allowed route string. The attack complexity is rated high.

Q: Which deployments are affected?

Tinyauth versions before 5.1.3 are affected. The provided information does not identify any configuration prerequisite beyond use of the vulnerable route-matching behavior.

Q: What is the immediate mitigation if upgrading is not possible?

The provided data does not specify a workaround. Prioritize upgrading to version 5.1.3 or later, which is outside the stated affected version range.

Published Sep 25, 2026

Updated

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

Affected Software

1 affected component

Tinyauth<5.1.3

Event History

Sep 25, 2026

CVE Published

via MITRE·03:58 AM

Data Sourced

via MITRE·03:58 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

The issue is remotely reachable and does not require authentication or user interaction, but successful exploitation depends on an attacker being able to craft a route that appends an allowed route string. The attack complexity is rated high.

Which deployments are affected?

Tinyauth versions before 5.1.3 are affected. The provided information does not identify any configuration prerequisite beyond use of the vulnerable route-matching behavior.

What is the immediate mitigation if upgrading is not possible?