Most recent entries from all

EUVD-2026-278111

fkie_cve-2026-33525

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.

GHSA-gmfg-3v4q-9qr4 — Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

Affected: Go: github.com/authelia/authelia/v4

### Impact

**Official Weighted Severity Rating:** Low

This exploit is very unlikely to be the case for most users as it requires configuration of the Content Security Policy template value. Below represents a safe value, **_any other value_** other than unconfigured should be **_very carefully evaluated_** regardless of the fix.

```yaml server: headers: csp_template: '' ```

```env AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE= ```

Provided the following conditions are met:

1. The Content Security Policy: 1. Has been disabled or modified from the entirely safe default value; and 2. Has been completely disabled by the Administrator by omitting the header explicitly at the proxy (worst practice); or 3. Has been effectively disabled by modifying `script-src` allowing unsafe inline scripts rather than using hashes AND effectively disabled by modifying `connect-src` allowing connections to arbitrary websites. 2. Authelia is being hosted on a domain that has other applications that can write to the cookie for the Authelia domain. 3. One of the other applications noted in 2 has an vulnerability that can be exploited to execute malicious javascript with similar requirements to 1. 4. The attacker can exploit the javascript in 3 to delete the existing `language` cookie scoped to the fully qualified domain name of Authelia with the same site value of `strict` (which is not possible in most scenarios unless the application in 3 has the exact same domain or a subdomain of t…