CVE-2026-47203: Authelia Auth Bypass Vulnerability

CVE-2026-47203 Overview

CVE-2026-47203 is a username canonicalization flaw in Authelia, an open-source authentication and authorization server that provides two-factor authentication and single sign-on (SSO). Versions 4.38.0 through 4.39.19 are affected. When a user authenticates via Basic Auth on the authz verification endpoint, Authelia passes the raw username from the Authorization header directly to the regulation system. Lightweight Directory Access Protocol (LDAP) treats usernames case insensitively, but the regulation SQL queries treat the lookup as case sensitive in certain scenarios. Each case variation of a username receives its own ban bucket, weakening brute-force protection.

Critical Impact
Attackers can bypass per-user authentication rate limiting and ban enforcement by varying the case of the target username across Basic Auth requests.

Affected Products

Authelia 4.38.0 through 4.39.19
Deployments using the authz verification endpoint with Basic Auth enabled
Authelia configurations backed by LDAP user directories

Discovery Timeline

2026-06-19 - CVE-2026-47203 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-47203

Vulnerability Analysis

The vulnerability is classified as [CWE-178] Improper Handling of Case Sensitivity. Authelia's authz verification endpoint accepts credentials via the HTTP Authorization header using the Basic scheme. The handler extracts the username verbatim and forwards it to the regulation subsystem, which records failed authentication attempts and enforces bans.

LDAP directories normalize usernames in a case-insensitive manner during bind operations. The Authelia regulation layer, however, queries its SQL store using case-sensitive comparisons in certain scenarios. As a result, john, John, and JOHN all bind to the same LDAP identity but maintain three independent regulation counters.

An attacker abusing this discrepancy can multiply the number of permitted authentication attempts against a single account by the number of distinct case permutations submitted. This degrades the effectiveness of brute-force protection but does not directly expose data, integrity, or availability beyond rate-limit evasion.

Root Cause

The root cause is missing canonicalization of the username extracted from Basic Auth credentials before it is passed to the regulation system. Identity comparison in the authentication backend (LDAP) and the regulation backend (SQL) follows different rules, creating an inconsistency between authentication identity and regulation identity.

Attack Vector

The attack is network-based and requires no prior authentication. An attacker sends repeated Basic Auth requests to the authz verification endpoint, cycling the case of the target username on each attempt. Each variant accumulates failures in a separate regulation bucket, allowing more guesses than the configured ban threshold would normally permit.

// Patch excerpt: internal/handlers/const.go
var (
    qryValueBasic = []byte("basic")
-   qryValueEmpty = []byte("")
)

// Patch excerpt: internal/handlers/handler_authz.go
    "fmt"
    "net"
    "net/url"
+   "time"

    "github.com/golang-jwt/jwt/v5"
    "github.com/sirupsen/logrus"

Source: Authelia commit b8985b5. The patch introduces basic auth username canonicalization so the regulation system receives a normalized identifier.

Detection Methods for CVE-2026-47203

Indicators of Compromise

Repeated Basic Auth failures against the Authelia authz endpoint where the same logical user appears with multiple case variations.
Regulation logs showing distinct ban buckets for usernames that LDAP resolves to a single account.
Authentication attempts from a single source IP cycling through case permutations of a known username.

Detection Strategies

Parse Authelia access and authentication logs for Authorization: Basic requests and group attempts by the lowercased username. Flag accounts where grouped failures exceed the configured regulation threshold.
Correlate LDAP bind failures with regulation table entries to identify mismatches between case variants and the canonical user.
Alert on bursts of authentication failures from a single client IP targeting the authz verification endpoint.

Monitoring Recommendations

Forward Authelia logs to a centralized logging or SIEM platform and apply normalization to the username field.
Track Basic Auth usage rates per endpoint, since the workaround disables this mechanism and any continued use is suspicious post-mitigation.
Monitor failed authentication ratios per source IP and per normalized username to detect rate-limit evasion attempts.

How to Mitigate CVE-2026-47203

Immediate Actions Required

Upgrade Authelia to version 4.39.20 or later, which contains the canonicalization fix.
If immediate patching is not possible, disable the Basic Auth mechanism on the authz verification endpoint.
Review regulation logs for evidence of case-permutation brute-force attempts and reset affected user credentials if compromise is suspected.

Patch Information

The fix is delivered in Authelia 4.39.20. The corrective commit b8985b5 canonicalizes the username extracted from the Authorization header before passing it to the regulation system. See the GitHub Security Advisory GHSA-hjj4-hfjm-fmrj and the upstream commit for technical detail.

Workarounds

Explicitly disable the Basic Auth scheme on the authz verification endpoint in the Authelia configuration.
Enforce strong, unique passwords and account lockout policies at the LDAP backend to reduce brute-force feasibility.
Restrict network access to the Authelia authz endpoint to trusted reverse proxies only.

bash

# Example: disable basic auth on the authz endpoint in configuration.yml
server:
  endpoints:
    authz:
      forward-auth:
        implementation: 'ForwardAuth'
        authn_strategies:
          - name: 'HeaderProxyAuthorization'
          # Remove or omit the 'HeaderAuthorization' (Basic) strategy
          - name: 'CookieSession'