CVE-2026-97736

Description

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

CVSS Vector

References

• https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-r27r-rr9v-vv37