CVE-2026-97736

EUVD-2026-86515
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
5.4 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 9.71%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tinyauthtinyauth
𝑥
< 5.1.3
CNA
Common Weakness Enumeration
References
https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37