EUVD-2026-84015Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote, unauthenticated, trivially scripted (AV:N/AC:L/PR:N/UI:N); only a temporary, self-expiring login DoS with no data impact, so C:N/I:N/A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.
AnalysisAI
Tinyauth versions prior to 5.1.0 can be forced into a temporary, instance-wide login lockdown by an unauthenticated remote attacker who sends POST /api/user/login requests using 257 distinct nonexistent usernames, filling the MaxLoginAttemptRecords limit so that legitimate users receive HTTP 429 responses until the default auth.loginTimeout of roughly 300 seconds elapses. The flaw is an availability-only, low-severity issue (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; CWE-307) that grants no confidentiality or integrity access and does not invalidate or degrade existing authenticated sessions; the attacker gains nothing beyond the temporary denial of new logins and must repeat the request burst to sustain it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network reachability - remote unauthenticated exploitation against default configurations of Tinyauth prior to 5.1.0, where lockdown mode (TINYAUTH_AUTH_LOCKDOWNENABLED) is enabled by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity availability issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Tinyauth 5.1.0 (https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0), which incorporates the fixes from PRs #943 and #1008 and commits 654b5cc436fc67865c1f55edf9ba9fbded50b74f and dade1e2c8f27a23df56ac216dcaf4b37081698e7 and removes the globally exploitable lockdown behavior; consult the advisory at https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-9xhm-w3wj-xhqh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today