Tinyauth is an authentication and authorization server that implements per‑application access‑control lists (ACLs). The vulnerability exists because Tinyauth compares the forwarded hostname in a case‑sensitive manner while the reverse proxy sends hostnames case‑insensitively. An attacker who is already authenticated with a low level of privilege can craft a hostname that differs only in letter case from the allowed value. The internal lookup for static ACLs or Docker‑label‑based ACLs then returns an empty access‑control object. The proxy handler interprets those empty rules as permissive, granting the authenticated user access to an application that should have been denied. The flaw does not affect unauthenticated traffic, and global login‑time allowlists remain intact, but it allows bypass of per‑app authorization checks.

TinyAuthApp Tinyauth version 5.1.1 and earlier are vulnerable. The issue was fixed in release 5.1.2. Anyone running an affected build of Tinyauth, regardless of deployment environment (standalone or with Docker), must consider this vulnerable.

The CVSS base score is 8.1, representing high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. The attack path requires that the attacker already has authenticated credentials and that the reverse proxy forwards a hostname whose case does not match the ACL entries. Because the flaw occurs after authentication, it cannot be triggered by unauthenticated users. Nonetheless, an authenticated attacker can freely access otherwise protected applications, risking data leakage or further privilege escalation. The likelihood of exploitation is moderate given the need for concurrent authentication and specific hostname manipulation.