Read the docs
TI-2026-34791 Aliases CVE-2026-47203GHSA-hjj4-hfjm-fmrj

Authelia Missing Username Canonicalization in Basic Auth (LDAP)

Priority LOW 15CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix Fixed authelia (authelia): 4.39.20github.com/authelia/authelia/v4 (Go): 4.39.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
autheliaauthelia4.38.0 to before 4.39.204.39.20Patch availableCNA
—github.com/authelia/authelia/v4 (Go)4.38.0 to before 4.39.204.39.20Patch availableGHSA-hjj4-hfjm-fmrj
  • authelia Vendorauthelia Affected 4.38.0 to before 4.39.20 Fixed in 4.39.20 Patch available CNA
  • github.com/authelia/authelia/v4 (Go) Vendor— Affected 4.38.0 to before 4.39.20 Fixed in 4.39.20 Patch available GHSA-hjj4-hfjm-fmrj

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:authelia:authelia:*:*:*:*:*:*:*:*——authelia
  • cpe:2.3:a:authelia:authelia:*:*:*:*:*:*:*:* Versions — — ·authelia

Remediation

  • Fix · CNA authelia (authelia) Fixed in 4.39.20
  • Fix · GHSA-hjj4-hfjm-fmrj github.com/authelia/authelia/v4 (Go) Fixed in 4.39.20 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47203
  2. 2026-10-03 Alias added: GHSA-hjj4-hfjm-fmrj

References

Advisory 1

Other 3

  • TI-2021-12305 Authentication bypassed with malformed request URI CVSS 3.1CRITICAL 10.0
  • TI-2021-10169 Authelia allows open redirects on the logout endpoint CVSS 3.1MEDIUM 5.7
  • TI-2025-18523 Regulation applies separately to Username-based logins to Email-based logins in authelia CVSS 4.0LOW 2.3
  • TI-2026-36064 Authelia has an Edge Case Access Control Rule Mismatch CVSS 4.0LOW 1.3
  • TI-2026-25918 Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting CVSS 4.0LOW 0.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences