Skip to content
OpenAdvisories

Vendor

authelia

6 known vulnerabilities.

authelia at a glance

Last 12 months
3
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202510
Jan 202500
Dec 202400

Products

authelia 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Low 1.3
    CVE-2026-48794

    Authelia has an Edge Case Access Control Rule Mismatch

    Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific …

    authelia authelia github.com/authelia/authelia/v4 github.com/authelia/authelia Go
  • Low 2.9
    CVE-2026-47203

    Authelia Missing Username Canonicalization in Basic Auth (LDAP)

    Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Autho…

    authelia authelia github.com/authelia/authelia/v4 github.com/authelia/authelia Go
  • Low 0.5
    CVE-2026-33525

    Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

    Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia l…

    authelia authelia github.com/authelia/authelia/v4 github.com/authelia/authelia Go
  • Low 2.3
    CVE-2025-24806

    Regulation applies separately to Username-based logins to Email-based logins in authelia

    Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these a…

    authelia authelia github.com/authelia/authelia/v4 github.com/authelia/authelia Go
  • Critical 10.0
    CVE-2021-32637

    Authentication bypassed with malformed request URI

    Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It …

    authelia authelia github.com/authelia/authelia/v4 Go
  • Medium 5.7
    CVE-2021-29456

    Authelia allows open redirects on the logout endpoint

    Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redir…

    authelia authelia github.com/authelia/authelia/v4 Go