CVE-2026-97736CWE-777

CVE-2026-97736

Medium · published September 25, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Weakness
CWE-777 · Regular Expression without Anchors
Published
2026-09-25T08:17Z
References (1)
https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 03:58Z
    tinyauth before 5.1.3 allows rule bypass by appending an allowed route string
    cvelistv5