Skip to content

tinyauth

v5.1.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 11d Reverse Proxies & Load Balancers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

2fa authentication caddy go middleware nginx
+6 more
oidc self-hosted sso tinyauth totp typescipt

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 11d

The v5.1.0 release fixes an open‑redirect vulnerability in the OpenID Connect server and hardens trusted proxy IP ACLs.

Why it matters: Severity 90 open redirect fix for OIDC servers; severity 70 hardened proxy ACLs require immediate security review.

Summary

AI summary

Updates Technical, https://github.com/tinyauthapp, and https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g across a mixed release.

Changes in this release

Security Critical

Fixes open redirect vulnerability in OpenID Connect server.

Fixes open redirect vulnerability in OpenID Connect server.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Uses loaded public key in OpenID Connect server when available.

Uses loaded public key in OpenID Connect server when available.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security High

Hardens trusted proxies configuration for IP ACLs.

Hardens trusted proxies configuration for IP ACLs.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Removes lockdown mode and reworks rate-limiting.

Removes lockdown mode and reworks rate-limiting.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Changes CLI flag from `--experimental.configfile` to `--configfile`.

Changes CLI flag from `--experimental.configfile` to `--configfile`.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds Tailscale authentication support.

Adds Tailscale authentication support.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Introduces deny‑by‑default access controls.

Introduces deny‑by‑default access controls.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds annotation‑based Kubernetes access controls.

Adds annotation‑based Kubernetes access controls.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds global IP bypass capability.

Adds global IP bypass capability.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds PostgreSQL as a database backend.

Adds PostgreSQL as a database backend.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Exposes all OpenID Connect claims through user attributes.

Exposes all OpenID Connect claims through user attributes.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Enables running Tinyauth on a top‑level domain as a standalone OIDC provider.

Enables running Tinyauth on a top‑level domain as a standalone OIDC provider.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Supports POST requests on the OIDC authorize endpoint.

Supports POST requests on the OIDC authorize endpoint.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds WebFinger support for OIDC discovery.

Adds WebFinger support for OIDC discovery.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds support for `prompt` parameter in OIDC flows.

Adds support for `prompt` parameter in OIDC flows.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds support for `max_age` parameter in OIDC authentication requests.

Adds support for `max_age` parameter in OIDC authentication requests.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds LDAP bind password file support.

Adds LDAP bind password file support.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds option to disable lockdown mode.

Adds option to disable lockdown mode.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Attempts reconnection to LDAP server on startup.

Attempts reconnection to LDAP server on startup.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Supports anonymous LDAP bind.

Supports anonymous LDAP bind.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Merges language and theme selector into a quick actions menu.

Merges language and theme selector into a quick actions menu.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Preserves login parameters throughout the frontend session.

Preserves login parameters throughout the frontend session.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Implements graceful shutdown on SIGTERM signal.

Implements graceful shutdown on SIGTERM signal.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Passes through LDAP mail attribute instead of crafting one when available.

Passes through LDAP mail attribute instead of crafting one when available.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Reworks CLI commands for simpler and more intuitive output.

Reworks CLI commands for simpler and more intuitive output.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Dependency Low

Switches package manager from Bun to PNPM.

Switches package manager from Bun to PNPM.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Dependency Low

Updates dependencies and translations.

Updates dependencies and translations.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Reworks dependency injection using Dig.

Reworks dependency injection using Dig.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Reworks the user context middleware.

Reworks the user context middleware.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Changes frontend API paths for app and user context (`/api/context/app`, `/api/context/user`).

Changes frontend API paths for app and user context (`/api/context/app`, `/api/context/user`).

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

Tinyauth v5.1.0

Hey everyone, this is Tinyauth v5.1.0, and Tinyauth is now officially OpenID Connect™ Certified thanks to the amazing help of @Rycochet and @scottmckendry. Additionally, this release brings a lot of improvements in access controls (deny-by-default and Kubernetes yay!), LDAP and general UX improvements. It also addresses some important security vulnerabilities (1, 2, 3) that were responsibly disclosed by our amazing community. Have fun ;)

yep, we using that everywhere now

[!NOTE]
Tinyauth has moved! All repositories now live under the new Tinyauth organization. Pull the new image from ghcr.io/tinyauthapp/tinyauth. The old image under my personal account will no longer be updated, so switch over when you can.

[!NOTE]
The config file is now a stable feature. Please switch your configuration file flag to --configfile (or TINYAUTH_CONFIGFILE for environment variables).

[!WARNING]
This release contains security fixes. Please update as soon as possible.

[!WARNING]
Tinyauth v5.1.0 includes some hardening in the trusted proxies. In case you are using any of the IP ACLs, you may need to specify your proxy IP in TINYAUTH_AUTH_TRUSTEDPROXIES.

New Features

Authentication & Access Controls

  • Support for authentication through Tailscale
  • Deny-by-default access controls
  • Annotation-based access controls in Kubernetes @contre95
  • Global bypass by IP @scottmckendry
  • Provider-specific OAuth whitelists @puneetdixit200
  • OAuth whitelist file support @djedditt
  • Allow for NO_PROXY, HTTP_PROXY and HTTPS_PROXY for OAuth requests @florianilch

OpenID Connect

  • Expose all OpenID Connect claims through user attributes @scottmckendry
  • Run Tinyauth on a top-level domain to use it as a standalone OIDC provider @jacekkow
  • POST request support on the OIDC authorize endpoint
  • WebFinger support
  • Support for prompt parameter in OIDC
  • Support for max_age in OIDC

Database & Config

  • PostgreSQL as a database backend @scottmckendry
  • LDAP bind password file support @Rycochet
  • Config file loading is now stable, you will need to rename your CLI flag from --experimental.configfile to --configfile
  • Option to disable lockdown mode
  • Attempt to reconnect to LDAP server on start-up
  • Support for anonymous LDAP bind @nv6

Frontend

  • Merge language and theme selector in new quick actions menu

Improvements

  • Preserve login parameters throughout the frontend
  • Graceful shutdown on SIGTERM
  • Pass through the LDAP mail attribute instead of crafting one when it's available
  • Rework CLI commands for simpler and more intuitive output

Fixes

  • Fix open redirect vulnerability in the OpenID Connect server @Dredsen
  • Use the loaded public key in the OpenID Connect server when available @Dredsen
  • Fix lax trusted proxies configuration in IP ACLs
  • Remove lockdown mode and rework rate-limiting

Technical

  • Rework dependency injection with Dig
  • Rework the user context middleware
  • Rework frontend user/app context API paths (changes in /api/context/app and /api/context/user)
  • Switch package manager from Bun to PNPM
  • Update dependencies and translations

New Contributors

  • @Rycochet made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/793
  • @contre95 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/627
  • @djedditt made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/826
  • @itasli made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/834
  • @Dredsen made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/854
  • @puneetdixit200 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/882
  • @nv6 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/979
  • @florianilch made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/999

Full Changelog: https://github.com/tinyauthapp/tinyauth/compare/v5.0.7...v5.1.0

Breaking Changes

  • Rename CLI config flag from `--experimental.configfile` to `--configfile` (or env var `TINYAUTH_CONFIGFILE`).
  • Change of repository location: pull images from `ghcr.io/tinyauthapp/tinyauth`; old personal‑account image will no longer be updated.
  • API path changes: `/api/context/app` and `/api/context/user` endpoints have been reworked.

Security Fixes

  • GHSA-456h-ww26-f758 — Open redirect vulnerability in the OIDC server.
  • GHSA-328g-jx67-v94g — Trusted proxies configuration laxness allowing IP ACL bypass.
  • GHSA-9xhm-w3wj-xhqh — Use of loaded public key in OIDC server when available.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track tinyauth

Get notified when new releases ship.

Sign up free

About tinyauth

The tiniest authentication and authorization server you have ever seen.

All releases →

Related context

Beta — feedback welcome: [email protected]