PT-2026-51025 · Authelia · Authelia

J0Hndo · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-48794

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Authelia versions 4.36.0 through 4.39.19

Description Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO). A lack of domain canonicalization in specific edge cases can allow an access control rule to be skipped. This occurs when the target resource uses forwarded authorization integration, the requested domain has two additional segments compared to the session domain, and there are two separate rules with inexact domain matches (such as wildcards, username, or group matches) ordered from most specific to least specific, where the second rule is more permissive. Exploitation requires the attacker to request a URL for the more specific domain where the second segment contains capitalized letters, provided the Envoy ExtAuthz integration is not used and the proxy does not canonicalize the requested host name in the header before sending it to the authorization endpoint.

Recommendations Upgrade to 4.39.20.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-178

CWE-863

Related Identifiers

CVE-2026-48794

Affected Products

Authelia

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48794 · Security Note
• https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a · Note
• https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8 · Note
• https://twitter.com/infoflowcloud/status/2068089077757366773 · Twitter Post
• https://twitter.com/CVEnew/status/2068087574795551160 · Twitter Post