HIGH8.1
GO-2026-6552
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth
Quick fix
GO-2026-6552 — github.com/tinyauthapp/tinyauth: upgrade to the fixed version with the command below.
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260720133915-80bc87188ec3Details
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/tinyauthapp/tinyauth
Introduced in:
0Fixed in: 1.0.1-0.20260720133915-80bc87188ec3Fix
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260720133915-80bc87188ec3References
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-77560[ADVISORY]
- https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275[FIX]
- https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399[FIX]
- https://github.com/tinyauthapp/tinyauth/pull/1000[FIX]
- https://github.com/tinyauthapp/tinyauth/pull/1028[FIX]
- https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2[WEB]