IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-09-21 17:18

MODIFIED

2026-09-21 17:18

CVSS_SCORE V3

8.1

EPSS (Prob. Exploit)

0.61%

Top 51.7%

DATA SOURCES:

NVD 🔗 2026-09-21 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-20 GITHUB 🔗 2026-10-15 OSV 🔗 2026-09-27

> DESCRIPTION

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EXPLOITABILITY

2.8

IMPACT

5.2

> MÉTRIQUES CVSS DÉTAILLÉES

                CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
            

Métrique	Valeur	Interprétation
AV (Vecteur d'Attaque) Attack Vector	Network (N)	Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque) Attack Complexity	Low (L)	Peu de conditions requises pour exploiter
PR (Privilèges Requis) Privileges Required	Low (L)	Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur) User Interaction	None (N)	Aucune interaction utilisateur nécessaire
S (Périmètre) Scope	Unchanged (U)	Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité) Confidentiality Impact	High (H)	Divulgation totale d'informations
I (Impact Intégrité) Integrity Impact	High (H)	Modification totale des données possible
A (Impact Disponibilité) Availability Impact	None (N)	Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité

High

Divulgation totale d'informations

Intégrité

High

Modification totale des données possible

Disponibilité

None

Aucune interruption de service

> WEAKNESSES

CWE-178 CWE-636 CWE-863

> CWE DETAILED DESCRIPTIONS

CWE-178: Improper Handling of Case Sensitivity - The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. | CWE-636: Not Failing Securely ('Failing Open') - When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. | CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

> GITHUB SECURITY ADVISORY

GHSA-328g-jx67-v94g HIGH

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

AFFECTED PACKAGES:

GO / github.com/tinyauthapp/tinyauth

< 1.0.1-0.20260720133915-80bc87188ec3

Fixed in: 1.0.1-0.20260720133915-80bc87188ec3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

AFFECTED PACKAGES:

Unknown / Unknown

145 versions affected

ALIASES:

GHSA-328g-jx67-v94g