Vulnerability · Published Jun 19, 2026 · Assigned by GitHub_M
CVE-2026-47203Authelia Missing Username Canonicalization in Basic Auth (LDAP)
Low 2.9
In plain English
A low-severity security flaw in authelia from authelia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/authelia/authelia | no fix listed | GO-2026-5430 |
| Go | github.com/authelia/authelia/v4 | 4.39.20 | GHSA-hjj4-hfjm-fmrj |
| Go | github.com/authelia/authelia/v4 | 4.39.20 | GO-2026-5430 |
Affected products (as reported)
Weakness: CWE-178, CWE-307 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P