# CVE-2026-77582: Tinyauth user enumeration via timing oracle

Source: https://junglewise.ai/threats/cve-2026-77582-tinyauth-user-enumeration-via-timing-oracle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77582 · Severity: medium · CVSS 4 · Published 2026-09-21

Tinyauth is an authentication server that manages user login attempts. A flaw allows attackers to determine whether a username exists by measuring how long login requests take—existing users have noticeably slower responses (~50ms) than non-existent users (~50µs), revealing valid account names without needing a password.

Technologies: [github.com/tinyauthapp/tinyauth (Go)](https://junglewise.ai/threats/technologies/github-com-tinyauthapp-tinyauth), [Tinyauth](https://junglewise.ai/threats/technologies/tinyauth). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-77582 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77582 being exploited in the wild.

**How severe is CVE-2026-77582?** Medium severity, with a CVSS score of 4, published 21 September 2026.

**Which products and versions are affected?** github.com/tinyauthapp/tinyauth (Go) < 1.0.1-0.20260714134959-c22925c2fba9, SEMVER:introduced=0,fixed=1.0.1-0.20260714134959-c22925c2fba9.

**Is there a fix for CVE-2026-77582?** Yes. github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260714134959-c22925c2fba9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77582 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77582?** Check whether you run github.com/tinyauthapp/tinyauth (Go) or Tinyauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/tinyauthapp/tinyauth (Go): upgrade to 1.0.1-0.20260714134959-c22925c2fba9 or later

  ```sh
  go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260714134959-c22925c2fba9
  ```


## Technical details

The vulnerability is a timing oracle in the user authentication logic. When a login request is processed, the application only performs expensive password-hash verification (bcrypt) for users that exist in the database. For non-existent users, the lookup fails immediately and returns an error without running the hash check, causing a ~1000x timing difference. An attacker can repeatedly attempt login with different usernames and measure response times to enumerate valid accounts. The fix involves performing a dummy bcrypt hash check even when a user is not found, ensuring consistent response times regardless of whether the user exists.

## Affected products

- Tinyauth

## Identifiers

- CVE-2026-77582
- GHSA-456h-ww26-f758
- GO-2026-6555

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: advisory

## Related threats

- [Tinyauth denial of service via login attempt map saturation](https://junglewise.ai/threats/cve-2026-77561-tinyauth-denial-of-service-via-login-attempt-map-saturation)
- [Tinyauth forward-auth authorization bypass via case-sensitive ACL matching](https://junglewise.ai/threats/cve-2026-77560-tinyauth-forward-auth-authorization-bypass-via-case-sensitive-acl)