tinyauth before version 5.1.3 contains an unanchored regular expression that permits attackers to bypass authentication rules by appending an allowed route string to the request string. This flaw enables unauthorized access to protected resources, potentially allowing attackers to retrieve sensitive data or perform actions without proper credentials.

The flaw affects the tinyauth application from all vendors listed under the CNA, specifically any installation before version 5.1.3. Systems running tinyauth 5.0.x or earlier are vulnerable. No other vendors or products are listed.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in the wild. Based on the description, the likely attack vector is through HTTP requests targeting the route handling logic. An attacker can construct a request that appends an allowed route string to the URL, triggering the unanchored regex and thereby bypassing the intended rule checks. No additional prerequisites beyond the ability to send crafted requests to the tinyauth service are required.