PT-2025-7545 · Authelia · Authelia

Ahrdie + 2 · Published 2025-02-19 · Updated 2025-03-13 · CVE-2025-24806

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Authelia versions prior to 4.38.19 Authelia version 4.39.0

Description Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email, the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled, assuming an attacker uses brute-force to find a user password. Due to the effective operation of regulation, where no user-facing sign of their regulation ban is visible, either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination or a effective ban blocking the attempt, which heavily mitigates any form of brute-force. This has a minimal impact on account security, which is increased naturally in scenarios when there is no two-factor authentication required and weak passwords are used, making it a bit easier to brute-force a password.

Recommendations For Authelia versions prior to 4.38.19, update to version 4.38.19 or later. For Authelia version 4.39.0, no additional action is required as this version already includes the patch. For users unable to upgrade, do not heavily modify the default settings in a way that ends up with shorter or less frequent regulation bans, as the default settings effectively mitigate any potential for this issue to be exploited. Disable the ability for users to login via an email address.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-24806

GHSA-M5MF-3963-4X26

GO-2025-3468

OPENSUSE-SU-2025:14889-1

Affected Products

Authelia

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24806.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24806 · Security Note
• https://osv.dev/vulnerability/GHSA-m5mf-3963-4x26 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3468 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24806 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://github.com/authelia/authelia · Note
• https://github.com/authelia/authelia/commit/d4a54189aa6563912f9427b96dcb01eacafa785c · Note
• https://github.com/authelia/authelia/security/advisories/GHSA-m5mf-3963-4x26 · Note
• https://suse.com/security/cve/CVE-2025-27507 · Note
• https://twitter.com/VulmonFeeds/status/1892389625429164130 · Twitter Post
• https://suse.com/security/cve/CVE-2025-25279 · Note
• https://suse.com/security/cve/CVE-2025-24526 · Note
• https://suse.com/security/cve/CVE-2025-27088 · Note
• https://suse.com/security/cve/CVE-2024-57604 · Note