CVE-2026-97736: tinyauth Auth Bypass Vulnerability

CVE-2026-97736 Overview

CVE-2026-97736 is an access control bypass vulnerability in tinyauth, an authentication middleware application. Versions prior to 5.1.3 contain an unanchored regular expression used to evaluate allowed routes. Attackers can bypass access rules by appending an allowed route string to a restricted URL. The flaw is tracked under CWE-777: Regular Expression without Anchors.

The issue was disclosed through a GitHub Security Advisory (GHSA-r27r-rr9v-vv37). No public exploit code is available, and the vulnerability is not listed in the CISA KEV catalog.

Critical Impact
Remote attackers can bypass tinyauth route protection rules without authentication by crafting URLs that contain allowed route strings, exposing restricted application paths.

Affected Products

tinyauth versions prior to 5.1.3
Applications deploying tinyauth as reverse-proxy authentication middleware
Deployments relying on tinyauth route-matching rules for access control

Discovery Timeline

2026-09-25 - CVE-2026-97736 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97736

Vulnerability Analysis

The vulnerability resides in the route-matching logic of tinyauth. The application compares incoming request paths against a configured list of allowed routes using a regular expression. The regex pattern lacks anchor metacharacters (^ and $), so it matches the allowed route string anywhere within the request URL rather than requiring an exact match.

An attacker can therefore craft a URL that targets a protected endpoint while embedding a substring that satisfies the permissive rule. The middleware incorrectly classifies the request as permitted and forwards it to the backend without enforcing authentication.

The weakness maps to CWE-777 (Regular Expression without Anchors). The scope change in the CVSS vector reflects that the authentication component bypassed does not own the resources being exposed; downstream applications protected by tinyauth suffer the confidentiality and integrity impact.

Root Cause

The root cause is an unanchored regular expression in the route authorization check. Without ^ at the start and $ at the end, the pattern evaluates as a substring search. Any URL that happens to contain the allowed route sequence is treated as a match, even when the actual target path is a protected resource.

Attack Vector

Exploitation requires only network access to a tinyauth-protected endpoint. The attacker appends or embeds an allowed route string within the request URL path or query component. Full technical details are available in the tinyauth GitHub Security Advisory.

Detection Methods for CVE-2026-97736

Indicators of Compromise

Access log entries where request URLs contain concatenations of protected paths and known-allowed route strings
Successful HTTP 200 responses to protected routes without a corresponding tinyauth session cookie
Unusual request patterns that embed allowed route substrings in unexpected positions within the URL

Detection Strategies

Audit tinyauth access logs for requests reaching protected backends while bypassing the authentication redirect flow
Correlate reverse-proxy logs with backend application logs to identify requests that lack authenticated user context
Deploy a web application firewall rule that flags request paths where allowed-route tokens appear after protected path segments

Monitoring Recommendations

Enable verbose logging on tinyauth to capture the route-matching decision for every request
Forward reverse-proxy and application logs to a central analytics platform for anomaly detection on authentication outcomes
Alert on sudden increases in direct access to normally gated administrative paths

How to Mitigate CVE-2026-97736

Immediate Actions Required

Upgrade tinyauth to version 5.1.3 or later across all deployments
Inventory services sitting behind tinyauth and verify none were accessed via bypass patterns during the exposure window
Rotate any credentials, API tokens, or session secrets that may have been exposed through protected routes

Patch Information

The maintainers fixed the issue in tinyauth 5.1.3 by anchoring the route-matching regular expression. Review the GitHub Security Advisory GHSA-r27r-rr9v-vv37 for the official fix and upgrade guidance.

Workarounds

Place an additional authentication layer in front of tinyauth until the upgrade is applied
Restrict network exposure of protected backends to trusted sources using firewall or ingress rules
Rewrite incoming URLs at the reverse proxy to strip trailing allowed-route substrings before tinyauth evaluation

bash

# Upgrade tinyauth container image to the patched release
docker pull ghcr.io/tinyauthapp/tinyauth:5.1.3
docker stop tinyauth && docker rm tinyauth
docker run -d --name tinyauth \
  -p 3000:3000 \
  ghcr.io/tinyauthapp/tinyauth:5.1.3