Go/github.com/tinyauthapp/tinyauth CVE-2026-77561: unknown, EPSS 0.60%

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth

Action: Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260715123057-dade1e2c8f27 or later.

go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260715123057-dade1e2c8f27

Affected

Fixed versions

Sources

• osv: GO-2026-6564
• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-9xhm-w3wj-xhqh
• https://nvd.nist.gov/vuln/detail/CVE-2026-77561
• https://github.com/tinyauthapp/tinyauth/commit/654b5cc436fc67865c1f55edf9ba9fbded50b74f
• https://github.com/tinyauthapp/tinyauth/commit/dade1e2c8f27a23df56ac216dcaf4b37081698e7
• https://github.com/tinyauthapp/tinyauth/pull/1008
• https://github.com/tinyauthapp/tinyauth/pull/943
• https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0

CVE-2026-77561 · published 2026-10-01T20:23:38Z · modified 2026-10-01T20:45:14.024702594Z · JSON