Tinyauth, an authentication and authorization server, prior to version 5.1.0, leaks information about valid usernames through observable timing differences during login attempts. Specifically, the loginHandler and basicAuth functions return quickly if a user does not exist, while existing users trigger bcrypt password verification, which takes longer. This timing discrepancy can be measured remotely and used to enumerate valid usernames, potentially aiding attackers in credential-based attacks. The vulnerability is tracked as CVE-2026-77582 and classified under CWE-208 (Observable Timing Discrepancy).

Attackers can remotely determine which usernames exist on the Tinyauth server by measuring response times during authentication attempts. This information disclosure facilitates targeted credential attacks such as brute force or password spraying against valid accounts. There is no indication of privilege escalation or direct code execution from this vulnerability alone.

Upgrade Tinyauth to version 5.1.0 or later, where this timing discrepancy vulnerability has been fixed. No other mitigation is indicated or necessary once the fix is applied.