Caesarakalaeii

**Name of the Vulnerable Software and Affected Versions** Authelia versions prior to 4.38.19 Authelia version 4.39.0 **Description** Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email, the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled, assuming an attacker uses brute-force to find a user password. Due to the effective operation of regulation, where no user-facing sign of their regulation ban is visible, either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination or a effective ban blocking the attempt, which heavily mitigates any form of brute-force. This has a minimal impact on account security, which is increased naturally in scenarios when there is no two-factor authentication required and weak passwords are used, making it a bit easier to brute-force a password. **Recommendations** For Authelia versions prior to 4.38.19, update to version 4.38.19 or later. For Authelia version 4.39.0, no additional action is required as this version already includes the patch. For users unable to upgrade, do not heavily modify the default settings in a way that ends up with shorter or less frequent regulation bans, as the default settings effectively mitigate any potential for this issue to be exploited. Disable the ability for users to login via an email address.