Description

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-25T04:17:50.977Z",
  "pubdate": "2026-09-25T04:17:50.977Z",
  "executiveSummary": "The tinyauth library before version 5.1.3 contains a critical security vulnerability involving improper input validation within its routing logic. The flaw is rooted in the use of unanchored regular expressions to evaluate requested route strings against authorized access rules.\nThis vulnerability allows an unauthenticated or unauthorized attacker to bypass established security constraints by crafting requests that append an allowed route string to a forbidden path. Because the regular expression does not enforce boundary anchors (such as start and end markers), the matching mechanism erroneously validates the malicious input as long as the permitted string exists anywhere within the provided path.\nThe impact of this vulnerability is significant, as it enables unauthorized access to restricted application endpoints, potentially leading to unauthorized data exposure, privilege escalation, or administrative command execution depending on the protected application's architecture.\nThe vulnerability affects all tinyauth versions prior to 5.1.3. There are no specialized privilege requirements for exploitation, as the flaw resides at the routing layer. Remediation necessitates an immediate update to the patched version.",
  "technicalDetails": "The core vulnerability lies in the implementation of route access control logic within tinyauth, which utilizes unanchored regular expressions to authorize requested URLs. In regular expression syntax, failing to anchor a pattern with start (^) and end ($) markers allows for partial matches throughout the string.\nWhen a user requests a path, the library evaluates this input against a whitelist of authorized routes. Because the regex pattern is unanchored, the matching engine succeeds if the allowed route string is merely a substring of the requested path. An attacker can exploit this behavior by manipulating the structure of the requested URL to include a legitimate, authorized route as a suffix or a subset of an unauthorized path.\nFor example, if an authorized route is defined as '/admin/profile' and the regex is unanchored, an attacker may attempt to access a sensitive, protected endpoint such as '/restricted/operation/admin/profile'. The regex engine will scan this malicious string, locate the authorized pattern '/admin/profile' within it, and return a positive match. Consequently, the library incorrectly grants access to the entire unauthorized path.\nThis flaw is persistent across all versions of tinyauth prior to 5.1.3. The vulnerability does not require prior authentication, as the failure occurs during the pre-processing of the request path, before authorization checks are finalized. The attack flow proceeds as follows: First, the attacker identifies a string associated with an authorized route. Second, the attacker prepends this string with arbitrary data or traverses directories to form a crafted URL that contains the authorized pattern. Third, the unanchored regex engine validates the crafted URL by matching only the authorized portion, ignoring the surrounding malicious context. Finally, the application erroneously routes the attacker to the restricted target.\nThe post-exploitation impact includes the circumvention of all downstream security controls that rely on tinyauth for request authorization. By successfully bypassing the routing filter, an attacker may interact with application functions that were intended to be hidden or restricted, potentially leading to unauthorized data manipulation, access to administrative functions, or complete system compromise."
}