An authorization bypass vulnerability in Tinyauth allows authenticated low-privilege users to circumvent per-application access restrictions.

The application performs case-sensitive hostname comparisons while underlying reverse proxies utilize case-insensitive routing. This discrepancy allows an authenticated user to access applications they are not authorized to reach by supplying a differently cased hostname, causing the service to return an empty access control object that defaults to permissive.

This vulnerability carries a CVSS score of 8.1 (High), reflecting the significant risk of unauthorized access to sensitive internal applications. Successful exploitation allows users to bypass security boundaries, potentially exposing protected data or internal services to unauthorized personnel, which could lead to severe data breaches or regulatory non-compliance.

Immediate Action: Upgrade Tinyauth to version 5.1.2 or later to resolve the hostname comparison logic.

Proactive Monitoring: Review authentication and access logs for suspicious patterns, such as multiple access attempts to restricted resources by low-privilege accounts using inconsistent hostname casing.

Compensating Controls: Ensure that reverse proxies are configured to normalize all incoming hostnames to a consistent case before forwarding requests to the Tinyauth service.

Public Exploit Available: Unknown

Given the ease of exploitation for authenticated users and the potential for unauthorized access to restricted applications, immediate remediation is required. Organizations should prioritize updating to version 5.1.2 to eliminate the underlying authorization bypass mechanism.