# CVE-2026-77560: Tinyauth forward-auth authorization bypass via case-sensitive ACL matching

Source: https://junglewise.ai/threats/cve-2026-77560-tinyauth-forward-auth-authorization-bypass-via-case-sensitive-acl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77560 · Severity: high · CVSS 8.1 · Published 2026-09-21

Tinyauth is a forward-auth proxy that enforces per-application access control rules for multi-app SSO deployments. An authenticated but unprivileged user can bypass the `users.allow`, `groups`, and IP-allowlist restrictions for any app on the same instance by requesting it with a mixed-case hostname (e.g., `IMMICH.example.com` instead of `immich.example.com`). Since the ACL lookup fails to find the app's rules and falls back to an empty configuration, any logged-in user is authorized to reach apps they should be denied access to, granting unauthorized read and write access to sensitive application data.

Technologies: [github.com/tinyauthapp/tinyauth (Go)](https://junglewise.ai/threats/technologies/github-com-tinyauthapp-tinyauth). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-77560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77560 being exploited in the wild.

**How severe is CVE-2026-77560?** High severity, with a CVSS score of 8.1, published 21 September 2026.

**Which products and versions are affected?** github.com/tinyauthapp/tinyauth (Go) < 1.0.1-0.20260720133915-80bc87188ec3, SEMVER:introduced=0,fixed=1.0.1-0.20260720133915-80bc87188ec3.

**Is there a fix for CVE-2026-77560?** Yes. github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77560 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77560?** Check whether you run github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260720133915-80bc87188ec3 or later

  ```sh
  go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260720133915-80bc87188ec3
  ```


## Technical details

Tinyauth performs per-app authorization by looking up the forwarded hostname in its ACL configuration using case-sensitive string comparisons (`config.Config.Domain == domain` and `strings.SplitN(domain, ".", 2)[0] == app`). HTTP hostnames are case-insensitive per RFC 4343, and reverse proxies (Traefik, Caddy, nginx, Envoy) route requests case-insensitively but forward the mixed-case host verbatim in headers like `X-Forwarded-Host`. When the lookup misses on a case mismatch, `GetAccessControls` falls back to `DockerService.GetLabels`, which returns an empty `config.App{}` with a nil error (fail-open behavior). An empty App authorizes any logged-in user because the default filters (`users.allow`, `oauth.groups`, etc.) return true when empty. The bypass affects all four proxy integrations and applies to any authenticated user not in the target app's allowlist. Patches are available in v5.1.2 or later.

## Affected products

- Tinyauth tinyauth < 5.1.2

## Identifiers

- CVE-2026-77560
- GHSA-328g-jx67-v94g
- GO-2026-6552

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: v5.1.2 available

## Related threats

- [Tinyauth user enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-77582-tinyauth-user-enumeration-via-timing-oracle)
- [Tinyauth denial of service via login attempt map saturation](https://junglewise.ai/threats/cve-2026-77561-tinyauth-denial-of-service-via-login-attempt-map-saturation)