{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/steveiliop56/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["tinyauth (\u003c 5.1.2)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","reverse-proxy","identity-management"],"_cs_type":"advisory","_cs_vendors":["steveiliop56"],"content_html":"\u003cp\u003etinyauth is a forward-auth service that acts as a gatekeeper for reverse proxies like Traefik, Caddy, Nginx, and Envoy. It verifies authentication and enforces per-app access control lists (ACLs) based on hostnames. An authorization bypass exists in tinyauth versions prior to 5.1.2 due to case-sensitive string comparisons when matching incoming hostnames against configured ACLs.\u003c/p\u003e\n\u003cp\u003eBecause DNS, HTTP routing, and TLS treat hostnames as case-insensitive, a reverse proxy will correctly route a mixed-case hostname (e.g., \u003ccode\u003eAPP.example.com\u003c/code\u003e) to the intended application. However, when tinyauth receives this request, its lookup logic fails to match the hostname because it performs a case-sensitive comparison. When the lookup fails, the application incorrectly falls back to an empty configuration object instead of denying access. This \u0026quot;fail-open\u0026quot; behavior grants authorized status to any already-authenticated user, effectively ignoring any per-app \u003ccode\u003eusers\u003c/code\u003e, \u003ccode\u003egroups\u003c/code\u003e, or \u003ccode\u003eip\u003c/code\u003e allowlists. This vulnerability allows an attacker with a valid session to bypass intended access restrictions for any protected app on the same instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a valid user session for the target tinyauth instance.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target application protected by an ACL that explicitly excludes their user account or group.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request for the target application using a mixed-case hostname (e.g., \u003ccode\u003eTargetApp.Example.Com\u003c/code\u003e instead of \u003ccode\u003etargetapp.example.com\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe reverse proxy receives the request, ignores the case difference, and routes it to the intended upstream backend.\u003c/li\u003e\n\u003cli\u003eThe proxy sends the request to tinyauth via the configured forward-auth endpoint, preserving the mixed-case hostname in the \u003ccode\u003eX-Forwarded-Host\u003c/code\u003e or \u003ccode\u003eHost\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003etinyauth's \u003ccode\u003eGetAccessControls\u003c/code\u003e function attempts to lookup the mixed-case hostname, fails to find a match due to case-sensitive logic, and returns an empty App configuration.\u003c/li\u003e\n\u003cli\u003eThe authorization logic evaluates the empty configuration, defaults to \u0026quot;allow,\u0026quot; and returns a \u003ccode\u003e200 Authenticated\u003c/code\u003e response to the reverse proxy.\u003c/li\u003e\n\u003cli\u003eThe proxy forwards the request to the upstream application, treating the attacker as an authorized user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to bypass per-app access restrictions, gaining full access to the data and functionality of restricted applications. This defeats the product's primary security feature - the per-app trust boundary - within multi-app SSO deployments. Impacted sectors include any organization relying on tinyauth to manage granular access to internal services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade tinyauth to version 5.1.2 or later immediately to resolve the case-insensitive matching logic.\u003c/li\u003e\n\u003cli\u003eAudit application access logs for unexpected \u003ccode\u003e200 OK\u003c/code\u003e responses from the forward-auth endpoint that correspond to known restricted users accessing sensitive subdomains.\u003c/li\u003e\n\u003cli\u003eValidate that your reverse proxy configuration and tinyauth instance are correctly synchronized regarding expected domain case-sensitivity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T01:55:12Z","date_published":"2026-09-23T01:55:12Z","id":"https://feed.craftedsignal.io/briefs/2026-09-tinyauth-bypass/","summary":"An authorization bypass vulnerability in tinyauth allows authenticated users to access restricted applications by manipulating the character casing of the request hostname, causing the service to fail open.","title":"tinyauth Authorization Bypass via Case-Sensitive Hostname Matching","url":"https://feed.craftedsignal.io/briefs/2026-09-tinyauth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Steveiliop56","version":"https://jsonfeed.org/version/1.1"}