Is CVE-2026-77561 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77561 being exploited in the wild.

How severe is CVE-2026-77561?

Medium severity, with a CVSS score of 5.3, published 21 September 2026.

Which products and versions are affected?

github.com/steveiliop56/tinyauth (Go) < 1.0.1-0.20260715123057-dade1e2c8f27, SEMVER:introduced=0,fixed=1.0.1-0.20260715123057-dade1e2c8f27; github.com/tinyauthapp/tinyauth (Go) SEMVER:introduced=0,fixed=1.0.1-0.20260715123057-dade1e2c8f27.

Is there a fix for CVE-2026-77561?

Yes. github.com/steveiliop56/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later; github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77561 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77561?

Check whether you run github.com/steveiliop56/tinyauth (Go) or github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77561: Tinyauth denial of service via login attempt map saturation

Q: Is there a fix for CVE-2026-77561?

Yes. github.com/steveiliop56/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later; github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77561 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-77561?

Check whether you run github.com/steveiliop56/tinyauth (Go) or github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77561 · Severity: medium · CVSS 5.3 · Published 2026-09-21

Tinyauth is an authentication service that controls login access and manages user accounts. An unauthenticated remote attacker can submit login requests using 257 different nonexistent usernames, causing the system to enter a global lockdown mode that blocks all users—including those with valid credentials—from logging in for up to 5 minutes. This attack can be repeated indefinitely, creating sustained denial of service for legitimate users.

Technologies: github.com/steveiliop56/tinyauth (Go), github.com/tinyauthapp/tinyauth (Go). Vendors: Go.

Quick answers

Is CVE-2026-77561 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77561 being exploited in the wild.
How severe is CVE-2026-77561?: Medium severity, with a CVSS score of 5.3, published 21 September 2026.
Which products and versions are affected?: github.com/steveiliop56/tinyauth (Go) < 1.0.1-0.20260715123057-dade1e2c8f27, SEMVER:introduced=0,fixed=1.0.1-0.20260715123057-dade1e2c8f27; github.com/tinyauthapp/tinyauth (Go) SEMVER:introduced=0,fixed=1.0.1-0.20260715123057-dade1e2c8f27.
Is there a fix for CVE-2026-77561?: Yes. github.com/steveiliop56/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later; github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77561 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77561?: Check whether you run github.com/steveiliop56/tinyauth (Go) or github.com/tinyauthapp/tinyauth (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/steveiliop56/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later
```
go get github.com/steveiliop56/tinyauth@v1.0.1-0.20260715123057-dade1e2c8f27
```
github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260715123057-dade1e2c8f27 or later
```
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260715123057-dade1e2c8f27
```

Technical details

The vulnerability is a denial-of-service flaw in Tinyauth's login rate-limiting mechanism. The root cause is that the `RecordLoginAttempt()` function records failed login attempts for both nonexistent usernames and incorrect passwords in a shared in-memory map, which has a hard cap of 256 entries. Once this cap is reached, the system activates a global lockdown mode that blocks login for all users, regardless of whether they provide correct credentials. An unauthenticated attacker can exploit this by submitting 257 POST requests to `/api/user/login` with unique nonexistent usernames; this triggers the lockdown without requiring any valid account knowledge. The lockdown persists for the configured `LoginTimeout` (default 300 seconds), during which `IsAccountLocked()` rejects all login attempts globally. No authentication, user interaction, or prior system compromise is required; the attack is exploitable over the network by any remote client with access to the login endpoint.

Affected products

Steveiliop56 Tinyauth v5.0.7 and likely earlier versions

Identifiers

CVE-2026-77561
GHSA-9xhm-w3wj-xhqh
GO-2026-6564

Timeline

2026-09-22: disclosed: GHSA-9xhm-w3wj-xhqh published
2026: other: CVE-2026-77561 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.