PT-2026-27623 · Authelia · Authelia

James D. Elliott + 1 · Published 2026-03-24 · Updated 2026-03-27 · CVE-2026-33525

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Authelia versions 4.39.15 Description Authelia is an open-source authentication and authorization server. An attacker may potentially be able to inject javascript into the Authelia login page if specific conditions are met, including modifications to the script-src and connect-src Content Security Policy directives. This is due to a lack of neutralization of the langauge cookie value when rendering the HTML template. The vulnerability is likely difficult to discover and exploit, requiring a secondary application with a vulnerability that allows execution of malicious javascript. The attacker would need to delete the existing language cookie and write a new one. Recommendations Upgrade to version 4.39.16. Downgrade to version 4.39.14.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33525

GHSA-GMFG-3V4Q-9QR4

GO-2026-4818

SUSE-SU-2026:1135-1

Affected Products

Authelia

References · 148

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33525.json · Exploit
• https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33525 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33525 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmfg-3v4q-9qr4 · Vendor Advisory
• https://github.com/authelia/authelia · Note
• https://suse.com/security/cve/CVE-2026-32254 · Note
• https://suse.com/security/cve/CVE-2026-32750 · Note
• https://suse.com/security/cve/CVE-2026-33219 · Note
• https://suse.com/security/cve/CVE-2026-33675 · Note
• https://suse.com/security/cve/CVE-2026-32805 · Note
• https://suse.com/security/cve/CVE-2026-26246 · Note
• https://suse.com/security/cve/CVE-2026-24516 · Note