CVE-2026-47203 Details
Description
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.
A vulnerability exists in Authelia versions 4.38.0 through 4.39.19, where usernames in Basic Authentication are not properly canonicalized before being processed for ban checks. This issue arises because LDAP usernames are case-insensitive, allowing variations like 'john', 'John', and 'JOHN' to be treated as the same user. However, the regulation system's SQL queries can be case-sensitive, creating separate ban records for different case variations. As a result, the effectiveness of brute-force password attacks is partially undermined, with attackers receiving no clear indication of successful password guesses.
Upgrade to Authelia version 4.39.20, which addresses this vulnerability by ensuring proper canonicalization of usernames in Basic Authentication. If an immediate upgrade is not possible, disable the Basic Authentication mechanism.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad | [email protected] | Source CodeVendor |
| https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Authelia | >= 4.38.0, <= 4.39.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |