CVE-2026-77560

Executive Summary

CVE-2026-77560 is an authentication bypass in Tinyauth, an authentication and authorization server, affecting versions prior to 5.1.2. Tinyauth validates forwarded hostnames case-sensitively while reverse proxies route hostnames case-insensitively, so an authenticated low-privilege user can present a differently cased hostname to dodge per-app access controls and receive an authenticated session for an application that should have excluded them. With a CVSS base score of 8.1 (High), the flaw enables high confidentiality and integrity impact against protected applications, though unauthenticated users still face the login flow and global login-time allowlists are not bypassed.

Technical Analysis

The vulnerability class is case-sensitivity inconsistency (CWE-178), specifically a mismatch between how two components of the same request pipeline normalize the same input: the reverse proxy and the application authorization logic.

Per the NVD description, Tinyauth compares forwarded hostnames case-sensitively. Reverse proxies, by contrast, route equivalent hostnames case-insensitively. This divergence creates a normalization gap: a request whose Host/forwarded host value differs only in letter case from the configured value is treated as a distinct hostname by Tinyauth's access-control lookup, even though the reverse proxy delivers it to the same backend and the same application.

The affected code paths named in the description:

• internal/service/access_controls_service.go — specifically the lookupStaticACLs and GetAccessControls lookup routines.
• internal/service/docker_service.go — the Docker-label fallback via GetLabels.
• internal/controller/proxy_controller.go — the proxyHandler.

Mechanism: when the forwarded hostname is submitted with different casing, the lookup in lookupStaticACLs / GetAccessControls fails to match the configured app, and the Docker-label fallback in GetLabels also misses. The result is an empty access-control object returned to the controller. proxyHandler then interprets the empty user, group, OAuth, LDAP, and IP restriction fields as permissive — an empty restriction set is treated as "allow" rather than "deny" — and returns an authenticated result for an application that should have excluded the user.

Key boundaries stated in the advisory:

• The bypass requires an already-authenticated, low-privilege user. It is a privilege/authorization bypass, not an authentication bypass for anonymous users.
• Unauthenticated users remain subject to login.
• Global login-time allowlists are not bypassed.
• The weakness is reachable over the network (AV:N), requires low privileges (PR:L), and needs no user interaction (UI:N).

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred from the vulnerability class and the described code flow.

Exploitation Scenarios

Preconditions: the attacker holds a valid low-privilege Tinyauth account; a reverse proxy in front of Tinyauth performs case-insensitive hostname routing; and at least one application is configured with per-app access controls that should exclude this user.

1. Reconnaissance / target identification. The attacker enumerates hostnames served behind the proxy and identifies one hosting a protected application whose allowlist should not include them. Because the proxy routes case-insensitively, alternate casings (e.g., the uppercase/lowercase variants of the same hostname) reach the same application.

2. Triggering the flaw. The attacker issues an authenticated request using a hostname whose letter case differs from the casing stored in Tinyauth's access-control configuration. Tinyauth's case-sensitive comparison in lookupStaticACLs / GetAccessControls, and the Docker-label fallback via GetLabels, fail to resolve the configured entry and return an empty access-control object.

3. Authorization bypass at the vulnerability-class level. proxyHandler in proxy_controller.go evaluates the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result — granting access to the application despite the configured exclusion. No payload injection is required; the "payload" is simply a differently cased hostname header.

4. Post-exploitation impact. The attacker gains authenticated access to an application they were explicitly excluded from, enabling read and modification of that application's data under their existing session (consistent with CVSS C:H/I:H). The bypass does not defeat global login-time allowlists or grant anonymous access, so lateral reach is bounded to per-app authorization decisions.

Impact Assessment

• Confidentiality (C:H): authenticated access to excluded applications exposes their data to unauthorized users.
• Integrity (I:H): the same access can permit modification of protected application state.
• Availability (A:N): no direct availability impact described.
• Attack Vector (AV:N) / Complexity (AC:L) / Privileges (PR:L) / User Interaction (UI:N) / Scope (S:U): remotely exploitable with a low-privilege account, no user interaction, no scope change — base score 8.1 (High).

Blast radius: every Tinyauth deployment (< 5.1.2) that (a) sits behind a case-insensitive reverse proxy and (b) relies on per-app access controls to exclude lower-privilege users. Multi-tenant or multi-app SSO environments with tiered access are most exposed because a single low-privilege account can pivot into higher-tier applications. Tinyauth is not listed in CISA KEV, and there is no evidence of in-the-wild exploitation.

Detection Guidance

Note: because the trigger is a case-variant Host header rather than a distinctive payload, detection should focus on hostname-case anomalies and on requests to restricted apps succeeding for users outside their allowlist.

Sigma Rule

title: Potential Tinyauth Host Case-Sensitivity Access Control Bypass (CVE-2026-77560)
id: 8f1c2a44-7756-4cve-9aa1-tinyauth0001
status: experimental
description: Detects requests whose forwarded host header differs only in letter case from configured application hostnames, consistent with the CWE-178 access-control bypass in Tinyauth < 5.1.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77560
author: valtersit.com
logsource:
  category: webserver
  product: tinyauth
detection:
  selection_forwarded:
    cs-host|contains: ''
    cs-method: 'GET'
  selection_status:
    sc-status: 200
  filter_configured:
    cs-host|re: '^[a-z0-9.-]+$'
  condition: selection_forwarded and selection_status and not filter_configured
falsepositives:
  - Legitimate requests using mixed-case hostnames where the proxy normalizes them
level: high
tags:
  - attack.t1078
  - cve.2026.77560

YARA Rule

rule CVE_2026_77560_Tinyauth_Host_Case_Bypass
{
    meta:
        description = "Detects Tinyauth artifacts/config referencing vulnerable access control lookups for CVE-2026-77560"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77560"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-77560"
    strings:
        $f1 = "access_controls_service.go" ascii
        $f2 = "lookupStaticACLs" ascii
        $f3 = "GetAccessControls" ascii
        $f4 = "docker_service.go" ascii
        $f5 = "GetLabels" ascii
        $f6 = "proxy_controller.go" ascii
        $f7 = "proxyHandler" ascii
    condition:
        filesize < 5MB and 3 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77560 Possible Tinyauth Host Case Access-Control Bypass Attempt"; flow:established,to_server; http.host; content:"."; pcre:"/Host:\s*[A-Z]/Hi"; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-77560; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77560; classtype:attempted-user; sid:2026775601; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "GET" and http.response.status_code == 200 and
   stringContains(http.request.headers.host, to_upper(substring(http.request.headers.host, 0, 1)))]

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined OR sourcetype=tinyauth
| eval host_raw=lower(cs_Host)
| where cs_Host != host_raw
| stats count values(cs_uri) as uris by src_ip, cs_Host
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="tinyauth,web,">
  <rule id="2026775" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers.host">\.</field>
    <regex>\"Host\":\s*\"[^"]*[A-Z][^"]*\"</regex>
    <description>CVE-2026-77560: Tinyauth possible host case-sensitivity access-control bypass attempt (mixed-case Host header to protected app)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue is fixed in version 5.1.2; no vendor advisory, commit, or release artifact is present in tracked sources, so confidence remains low until verified against the vendor.

1. Immediate mitigations

   • Normalize or reject non-canonical hostnames at the reverse proxy: lowercase the Host/forwarded host before it reaches Tinyauth, and enable strict host validation so case-variant hostnames map to a single canonical app.
   • Where feasible, deny requests whose host case does not match the canonical configured value at the proxy layer.
   • Restrict low-privilege accounts and audit which users can reach applications they are not explicitly allowlisted for.

2. Patch/upgrade steps

   • Upgrade Tinyauth to 5.1.2 or later, which the advisory states fixes the case-sensitivity inconsistency.
   • Verify the release artifact and checksum against the vendor's official distribution before deploying.
   • After upgrading, re-validate per-app access controls with case-varied hostnames to confirm matching is now case-insensitive.

3. Long-term hardening

   • Enforce a single canonical hostname normalization step shared by the reverse proxy and the authorization service.
   • Adopt fail-closed semantics: an empty or unresolved access-control object should deny by default rather than be treated as permissive.
   • Add regression tests covering case variations of hostnames in access-control lookups (lookupStaticACLs, GetAccessControls, GetLabels) and in proxyHandler.

References

• NVD — CVE-2026-77560: https://nvd.nist.gov/vuln/detail/CVE-2026-77560
• Tinyauth project repository/advisories: https://github.com/steveiliop56/tinyauth (verify the 5.1.2 release note for the fix)
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-77560 not listed)

No public PoC, Nuclei template, or exploit code is available, and there is no evidence of active exploitation or known threat-actor campaigns targeting this CVE at the time of writing.