Read the docs
TI-2021-10169 Aliases CVE-2021-29456GHSA-36f2-fcrx-fp4j

Authelia allows open redirects on the logout endpoint

Priority LOW 26CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any domain, including potentially malicious sites. This security issue does not directly impact the security of the web application itself. As a workaround, one can use a reverse proxy to strip the query parameter from the affected endpoint. There is a patch for version 4.28.0.

Why it matters now

EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Fixed github.com/authelia/authelia/v4 (Go): 4.28.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
autheliaautheliaup to 4.27.4—No fix listedCNA
—github.com/authelia/authelia/v4 (Go)before 4.28.04.28.0Patch availableGHSA-36f2-fcrx-fp4j
  • authelia Vendorauthelia Affected up to 4.27.4 Fixed in — No fix listed CNA
  • github.com/authelia/authelia/v4 (Go) Vendor— Affected before 4.28.0 Fixed in 4.28.0 Patch available GHSA-36f2-fcrx-fp4j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:authelia:authelia:*:*:*:*:*:*:*:*before 4.28.0Vulnerableauthelia
  • cpe:2.3:a:authelia:authelia:*:*:*:*:*:*:*:* Versions before 4.28.0 Vulnerable ·authelia

Remediation

  • Fix · GHSA-36f2-fcrx-fp4j github.com/authelia/authelia/v4 (Go) Fixed in 4.28.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29456
  2. 2026-10-03 Alias added: GHSA-36f2-fcrx-fp4j

References

Patch 1

Advisory 1

Other 1

  • TI-2021-12305 Authentication bypassed with malformed request URI CVSS 3.1CRITICAL 10.0
  • TI-2026-25918 Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting CVSS 4.0LOW 0.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences