PT-2026-45030 · Authelia · Authelia
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Authelia versions 4.38.0 through 4.39.19
Description
When using the LDAP authentication backend, the authz verification endpoint fails to canonicalize usernames provided via Basic Auth in the
Authorization header. Because LDAP treats usernames case-insensitively while the regulation SQL queries may treat them as case-sensitive, different case variations of the same username (e.g., john, John, JOHN) are treated as distinct entities for ban checking and attempt recording. This allows each case variation to have its own ban bucket, partially degrading the effectiveness of the brute force protection mechanism.Recommendations
Upgrade to version 4.39.20.
As a temporary workaround, explicitly disable the basic auth mechanism.
Exploit
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Authelia