CVSS 4.0
2.9 lowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:PCVE-2026-47203
Low (2.9). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/authelia/authelia/v4 4.39.20.
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-178, CWE-307
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hjj4-hfjm-fmrj | Go | github.com/authelia/authelia/v4 | >=4.38.0 <4.39.20 | 4.39.20 |
| GO-2026-5430 | Go | github.com/authelia/authelia | all versions | no fix published |
| GO-2026-5430 | Go | github.com/authelia/authelia/v4 | >=4.38.0 <4.39.20 | 4.39.20 |