Executive brief
Tinyauth is an authentication service that controls login access and manages user accounts. An unauthenticated remote attacker can submit login requests using 257 different nonexistent usernames, causing the system to enter a global lockdown mode that blocks all users—including those with valid credentials—from logging in for up to 5 minutes. This attack can be repeated indefinitely, creating sustained denial of service for legitimate users.
Technical details
The vulnerability is a denial-of-service flaw in Tinyauth's login rate-limiting mechanism. The root cause is that the `RecordLoginAttempt()` function records failed login attempts for both nonexistent usernames and incorrect passwords in a shared in-memory map, which has a hard cap of 256 entries. Once this cap is reached, the system activates a global lockdown mode that blocks login for all users, regardless of whether they provide correct credentials. An unauthenticated attacker can exploit this by submitting 257 POST requests to `/api/user/login` with unique nonexistent usernames; this triggers the lockdown without requiring any valid account knowledge. The lockdown persists for the configured `LoginTimeout` (default 300 seconds), during which `IsAccountLocked()` rejects all login attempts globally. No authentication, user interaction, or prior system compromise is required; the attack is exploitable over the network by any remote client with access to the login endpoint.
Affected products
- Steveiliop56 Tinyauth v5.0.7 and likely earlier versions
Timeline
- 2026-09-22: disclosed: GHSA-9xhm-w3wj-xhqh published
- 2026: other: CVE-2026-77561 assigned