MEDIUM5.3
GO-2026-6564
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth
Quick fix
GO-2026-6564 — github.com/tinyauthapp/tinyauth: upgrade to the fixed version with the command below.
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260715123057-dade1e2c8f27Details
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/tinyauthapp/tinyauth
Introduced in:
0Fixed in: 1.0.1-0.20260715123057-dade1e2c8f27Fix
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260715123057-dade1e2c8f27References
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-9xhm-w3wj-xhqh[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-77561[ADVISORY]
- https://github.com/tinyauthapp/tinyauth/commit/654b5cc436fc67865c1f55edf9ba9fbded50b74f[FIX]
- https://github.com/tinyauthapp/tinyauth/commit/dade1e2c8f27a23df56ac216dcaf4b37081698e7[FIX]
- https://github.com/tinyauthapp/tinyauth/pull/1008[FIX]
- https://github.com/tinyauthapp/tinyauth/pull/943[FIX]
- https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0[WEB]