The vulnerability permits an unauthenticated remote attacker to trigger a global login lockdown by submitting 257 distinct nonexistent usernames in POST \/api\/user\/login requests. Each request records a login attempt that contributes to an internal map; when the map reaches its cap the application enters lockdown mode. During lockdown all subsequent login attempts, including those from legitimate users, receive HTTP 429 responses for approximately 300 seconds. The attack does not compromise data confidentiality or invalidate existing sessions, but it does deny authentication services to all users. The likely attack vector is remote HTTP requests to /api/user/login, inferred from the description.

All releases of tinyauth produced by tinyauthapp before version 5.1.0 are vulnerable. Versions 5.1.0 and later include the fix.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only repeated POST /api/user/login requests with distinct usernames, no authentication or privileged access is needed. The attacker can repeat the attack, but the impact window is limited to roughly five minutes per trigger. Overall, the risk is moderate; there is a clear exploitation path and a global denial effect, though the lack of EPSS data makes current exploitation probability uncertain.