Executive brief
Tinyauth is an authentication server that manages user login attempts. A flaw allows attackers to determine whether a username exists by measuring how long login requests take—existing users have noticeably slower responses (~50ms) than non-existent users (~50µs), revealing valid account names without needing a password.
Technical details
The vulnerability is a timing oracle in the user authentication logic. When a login request is processed, the application only performs expensive password-hash verification (bcrypt) for users that exist in the database. For non-existent users, the lookup fails immediately and returns an error without running the hash check, causing a ~1000x timing difference. An attacker can repeatedly attempt login with different usernames and measure response times to enumerate valid accounts. The fix involves performing a dummy bcrypt hash check even when a user is not found, ensuring consistent response times regardless of whether the user exists.
Affected products
- Tinyauth
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory