{"action":"Upgrade github.com/tinyauthapp/tinyauth to 1.0.1-0.20260720133915-80bc87188ec3 or later.","affected":[{"fixed":"1.0.1-0.20260720133915-80bc87188ec3","introduced":"0"}],"component":"github.com/tinyauthapp/tinyauth","cve_ids":["CVE-2026-77560"],"ecosystem":"Go","epss":0.00612,"exploited":false,"fixed_versions":["1.0.1-0.20260720133915-80bc87188ec3"],"ghsa_id":"GHSA-328g-jx67-v94g","id":"tcs_01M5KESY7RP45A6BJPPQT4MYP7","modified_at":"2026-10-01T20:56:18.875153850Z","published_at":"2026-09-22T20:37:08Z","references":["https://osv.dev/vulnerability/GHSA-328g-jx67-v94g","https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g","https://nvd.nist.gov/vuln/detail/CVE-2026-77560","https://github.com/tinyauthapp/tinyauth/pull/1000","https://github.com/tinyauthapp/tinyauth/pull/1028","https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275","https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399","https://github.com/tinyauthapp/tinyauth","https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-328g-jx67-v94g","url":"https://osv.dev/vulnerability/GHSA-328g-jx67-v94g"}],"summary":"Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for"}