CVE-2026-77560: Tinyauth Authentication Bypass Vulnerability

CVE-2026-77560 Overview

Tinyauth is an authentication and authorization server used to protect applications behind reverse proxies. CVE-2026-77560 is an authorization bypass vulnerability affecting Tinyauth versions prior to 5.1.2. The flaw stems from case-sensitive hostname comparisons in Tinyauth while reverse proxies route hostnames case-insensitively. An authenticated low-privilege user can bypass per-application access controls by requesting a resource with a differently cased hostname. The issue is fixed in version 5.1.2 and is tracked under [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Authenticated low-privilege users can access applications they should be excluded from by sending requests with alternate hostname casing, defeating per-app user, group, OAuth, LDAP, and IP restrictions.

Affected Products

Tinyauth authentication and authorization server
All versions prior to 5.1.2
Deployments using per-app access control lists (ACLs) with Docker label or Kubernetes providers

Discovery Timeline

2026-09-21 - CVE-2026-77560 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77560

Vulnerability Analysis

The vulnerability arises from an inconsistency between how reverse proxies and Tinyauth handle hostnames. Reverse proxies match host headers case-insensitively per RFC 3986. Tinyauth's access control lookup uses case-sensitive string comparison. This mismatch allows an attacker to reach a protected upstream while bypassing the ACL configured for that host.

The faulty logic sits in internal/service/access_controls_service.go inside lookupStaticACLs and GetAccessControls. The Docker label fallback in internal/service/docker_service.go through GetLabels also fails to locate the intended app when hostname casing differs. When the lookup misses, the code returns an empty access control object.

internal/controller/proxy_controller.go in proxyHandler then evaluates this empty ACL. Empty user, group, OAuth, LDAP, and IP restriction fields are treated as permissive. The proxy returns an authenticated result and forwards the request to an application that should exclude the requesting user.

Root Cause

The root cause is inconsistent case normalization between components. Domain names are case-insensitive by protocol, but Tinyauth compared them with byte-level equality. Additionally, an empty ACL response was interpreted as "no restriction" rather than as a lookup miss requiring a deny decision. This fail-open default compounded the case-sensitivity bug.

Attack Vector

An authenticated low-privilege user identifies an application protected by per-app ACLs that exclude them, for example app.example.com. The attacker sends a request through the same reverse proxy with an alternately cased hostname such as App.Example.com. The reverse proxy routes the request to Tinyauth for forward authentication. Tinyauth's case-sensitive lookup fails to match the configured ACL, returns an empty ACL, and the proxy handler produces an allow decision.

Unauthenticated users are still redirected to login. Global login-time allowlists remain enforced. The bypass targets per-app authorization only.

// Patch excerpt: internal/service/access_controls_service.go
// Refactor of ACL fetching for Kubernetes and Docker (PR #1028)
type LabelProvider interface {
-	GetLabels(appDomain string) (*model.App, error)
+	Lookup(locator func(name string, app *model.App) bool) error
}

type AccessControlsService struct {
// Source: https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275

The patch replaces direct label fetching with a locator callback, allowing the caller to control matching semantics and apply case-insensitive comparisons.

Detection Methods for CVE-2026-77560

Indicators of Compromise

Reverse proxy access logs showing requests to protected hosts using non-canonical casing such as App.Example.com or EXAMPLE.COM.
Tinyauth authentication events indicating an allow decision for a user against an app that appears in ACL configuration as excluded.
Repeated forward-auth requests from the same authenticated session to multiple hostname casing variants of the same application.

Detection Strategies

Correlate reverse proxy Host header values with the canonical lowercase hostname configured in Tinyauth. Alert on mismatches.
Compare authenticated user identity in Tinyauth decisions against the per-app ACL configuration. Flag allow decisions that violate configured user, group, OAuth, LDAP, or IP restrictions.
Hunt for empty ACL evaluations in Tinyauth service logs preceding proxy allow decisions.

Monitoring Recommendations

Ingest Tinyauth, reverse proxy (Traefik, nginx, Caddy), and application logs into a centralized analytics platform for cross-source correlation.
Build a rule that normalizes hostnames to lowercase in both proxy and Tinyauth logs, then joins them to detect casing anomalies.
Monitor for privilege deviation, where a user accesses upstream applications outside their assigned entitlement set.

How to Mitigate CVE-2026-77560

Immediate Actions Required

Upgrade Tinyauth to version 5.1.2 or later, which contains the case-insensitive lookup fix from PR #1028 and PR #1000.
Audit reverse proxy configurations to ensure host header handling and Tinyauth ACL definitions use consistent lowercase hostnames.
Review authentication logs for prior allow decisions against sensitive applications that may indicate historical exploitation.

Patch Information

The fix is available in Tinyauth v5.1.2. Relevant commits are 80bc871, which reworks ACL fetching for Kubernetes and Docker, and e75605b, which centralizes domain comparison into a helper utility. Details are published in GitHub Security Advisory GHSA-328g-jx67-v94g.

Workarounds

Configure the reverse proxy to normalize the Host header to lowercase before forwarding to Tinyauth for authentication.
Restrict access to protected applications at the network or proxy layer using additional allowlists that do not depend on Tinyauth ACL evaluation.
Temporarily disable low-privilege accounts whose access to sensitive per-app resources depends solely on Tinyauth ACL enforcement.

bash

# Traefik middleware example: normalize Host header casing before forward-auth
# Apply to routers that use tinyauth as forwardAuth
http:
  middlewares:
    lowercase-host:
      plugin:
        rewriteHeaders:
          rewrites:
            - header: Host
              regex: "(.*)"
              replacement: "${1,,}"
    tinyauth-forwardauth:
      forwardAuth:
        address: "http://tinyauth:3000/api/auth/traefik"