medium5.4
CVE-2026-97736
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.
Impact
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
Affected products
| Product | Affected versions |
|---|---|
| Tinyauth | before 5.1.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.