MEDIUM6.9
GO-2026-6555
Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth
Quick fix
GO-2026-6555 — github.com/tinyauthapp/tinyauth: upgrade to the fixed version with the command below.
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260714134959-c22925c2fba9Details
Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/tinyauthapp/tinyauth
Introduced in:
0Fixed in: 1.0.1-0.20260714134959-c22925c2fba9Fix
go get github.com/tinyauthapp/tinyauth@v1.0.1-0.20260714134959-c22925c2fba9References
- https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-77582[ADVISORY]
- https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310[FIX]
- https://github.com/tinyauthapp/tinyauth/pull/1004[FIX]
- https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0[WEB]