The vulnerability is a timing side‑channel that allows an attacker to discover valid local usernames by measuring the response time of the authentication endpoint. During login attempts, the server quickly returns a failure response for nonexistent usernames, while it performs bcrypt password verification for existing users, which takes noticeably longer. By repeatedly measuring these differences, an attacker can reliably enumerate the set of valid usernames, and then target those accounts with credential‑guessing or other attacks. The weakness is described by CWE‑208, representing a timing attack.

Affected products are the tinyauth authentication server from the vendor tinyauthapp. Versions prior to 5.1.0 are vulnerable. The vendor released a fix in the 5.1.0 release that removes the timing discrepancy. No other version or component information is explicitly listed.

The CVSS score of 6.9 indicates moderate severity for the vulnerability. EPSS information is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker can exploit the public authentication API over the network. By sending numerous login requests and timing the responses, a malicious actor can enumerate valid usernames, then move to credential‑stuffing or brute‑force attacks. The exploit requires no privileged access or local exploits, making it a low‑effort threat for attackers who can reach the authentication service.