Is CVE-2026-77560 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77560 being exploited in the wild.

How severe is CVE-2026-77560?

High severity, with a CVSS score of 8.1, published 21 September 2026.

Which products and versions are affected?

github.com/tinyauthapp/tinyauth (Go) < 1.0.1-0.20260720133915-80bc87188ec3, SEMVER:introduced=0,fixed=1.0.1-0.20260720133915-80bc87188ec3.

Is there a fix for CVE-2026-77560?

Yes. github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77560 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-77560?

Check whether you run github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77560: Tinyauth forward-auth authorization bypass via case-sensitive ACL matching

Q: Is there a fix for CVE-2026-77560?

Yes. github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77560 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-77560?

Check whether you run github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77560 · Severity: high · CVSS 8.1 · Published 2026-09-21

Tinyauth is a forward-auth proxy that enforces per-application access control rules for multi-app SSO deployments. An authenticated but unprivileged user can bypass the `users.allow`, `groups`, and IP-allowlist restrictions for any app on the same instance by requesting it with a mixed-case hostname (e.g., `IMMICH.example.com` instead of `immich.example.com`). Since the ACL lookup fails to find the app's rules and falls back to an empty configuration, any logged-in user is authorized to reach apps they should be denied access to, granting unauthorized read and write access to sensitive application data.

Technologies: github.com/tinyauthapp/tinyauth (Go). Vendors: Go.

Quick answers

Is CVE-2026-77560 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77560 being exploited in the wild.
How severe is CVE-2026-77560?: High severity, with a CVSS score of 8.1, published 21 September 2026.
Which products and versions are affected?: github.com/tinyauthapp/tinyauth (Go) < 1.0.1-0.20260720133915-80bc87188ec3, SEMVER:introduced=0,fixed=1.0.1-0.20260720133915-80bc87188ec3.
Is there a fix for CVE-2026-77560?: Yes. github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77560 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77560?: Check whether you run github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later
```
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260720133915-80bc87188ec3
```

Technical details

Tinyauth performs per-app authorization by looking up the forwarded hostname in its ACL configuration using case-sensitive string comparisons (`config.Config.Domain == domain` and `strings.SplitN(domain, ".", 2)[0] == app`). HTTP hostnames are case-insensitive per RFC 4343, and reverse proxies (Traefik, Caddy, nginx, Envoy) route requests case-insensitively but forward the mixed-case host verbatim in headers like `X-Forwarded-Host`. When the lookup misses on a case mismatch, `GetAccessControls` falls back to `DockerService.GetLabels`, which returns an empty `config.App{}` with a nil error (fail-open behavior). An empty App authorizes any logged-in user because the default filters (`users.allow`, `oauth.groups`, etc.) return true when empty. The bypass affects all four proxy integrations and applies to any authenticated user not in the target app's allowlist. Patches are available in v5.1.2 or later.

Affected products

Tinyauth tinyauth < 5.1.2

Identifiers

CVE-2026-77560
GHSA-328g-jx67-v94g
GO-2026-6552

Timeline

2026-09-22: disclosed
2026-09-22: patched: v5.1.2 available

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.