Go/github.com/tinyauthapp/tinyauth CVE-2026-77582: medium 6.9, EPSS 0.63%

Tinyauth: User enumeration attack by timing oracle

Action: Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260714134959-c22925c2fba9 or later.

go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260714134959-c22925c2fba9

Affected

Fixed versions

Sources

• osv: GHSA-456h-ww26-f758
• nvd: CVE-2026-77582
• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758
• https://github.com/tinyauthapp/tinyauth/pull/1004
• https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310
• https://github.com/tinyauthapp/tinyauth
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0

CVE-2026-77582 · published 2026-09-22T20:37:06Z · modified 2026-10-01T20:56:17.798738861Z · JSON