CVE-2026-97736 - Vulnerability Details - OpenCVE

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Tinyauth	Tinyauth

No data.

No data.

References

Link	Providers
https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37

History

Sat, 26 Sep 2026 23:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 25 Sep 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
First Time appeared		Tinyauth Tinyauth tinyauth
Weaknesses		CWE-777
CPEs		cpe:2.3:a:tinyauth:tinyauth::::::::
Vendors & Products		Tinyauth Tinyauth tinyauth
References		https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-09-25T03:58:59.842Z

Updated: 2026-09-26T22:51:19.279Z

Reserved: 2026-09-25T03:58:58.954Z

Link: CVE-2026-97736

Vulnrichment

Updated: 2026-09-26T22:48:34.427Z

NVD

Status : Deferred

Published: 2026-09-25T04:17:50.977

Modified: 2026-09-30T17:32:07.107

Link: CVE-2026-97736

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97736", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-25T03:58:58.954Z", "datePublished": "2026-09-25T03:58:59.842Z", "dateUpdated": "2026-09-26T22:51:19.279Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://proxy.golang.org", "defaultStatus": "unaffected", "modules": ["forward-auth per-app path ACL"], "packageName": "github.com/tinyauthapp/tinyauth", "product": "tinyauth", "programFiles": ["internal/service/access_controls_rules.go"], "repo": "https://github.com/tinyauthapp/tinyauth", "vendor": "tinyauth", "versions": [{"lessThan": "5.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-777", "description": "CWE-777 Regular Expression without Anchors", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T03:58:59.842Z"}, "references": [{"url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.1.3"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T22:41:43.626491Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T22:51:19.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T22:41:43.626491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T22:48:34.427Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/tinyauthapp/tinyauth", "vendor": "tinyauth", "modules": ["forward-auth per-app path ACL"], "product": "tinyauth", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.3", "versionType": "semver"}], "packageName": "github.com/tinyauthapp/tinyauth", "programFiles": ["internal/service/access_controls_rules.go"], "collectionURL": "https://proxy.golang.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-777", "description": "CWE-777 Regular Expression without Anchors"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tinyauth:tinyauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.1.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T03:58:59.842Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97736", "state": "PUBLISHED", "dateUpdated": "2026-09-26T22:51:19.279Z", "dateReserved": "2026-09-25T03:58:58.954Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-25T03:58:59.842Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}