CVE-2026-48794: Authelia Auth Bypass Vulnerability

CVE-2026-48794 Overview

CVE-2026-48794 affects Authelia, an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. The vulnerability stems from a lack of canonicalization of domains in narrow edge cases. Authelia versions 4.36.0 through 4.39.19 may skip an access control rule that should match a request when capitalized characters appear in specific positions of the requested host. The flaw is categorized as an improper resolution of case sensitivity issue [CWE-178]. Exploitation requires a chain of preconditions involving forwarded authorization integration, ordered wildcard rules, and a proxy that forwards uncanonicalized host headers.

Critical Impact
An attacker can cause a more permissive access control rule to be matched instead of a more specific rule, potentially bypassing intended authorization restrictions on subdomains.

Affected Products

Authelia versions 4.36.0 through 4.39.19
Deployments using the forwarded authorization integration (excluding Envoy ExtAuthz)
Configurations with ordered wildcard domain rules where a less specific rule is more permissive

Discovery Timeline

2026-06-19 - CVE-2026-48794 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48794

Vulnerability Analysis

The vulnerability resides in Authelia's access control domain matcher. When evaluating wildcard domain rules, the matcher used Go's strings.HasSuffix for comparison. This function performs byte-level matching and is case-sensitive. If a request arrives with mixed-case characters in the hostname and the proxy does not lowercase the host header before forwarding, the case-sensitive suffix check fails to match the intended rule. Authelia then continues evaluation against subsequent, less-specific rules, which may yield a more permissive decision than the policy author intended.

The exploitation chain requires all of the following conditions: the target uses forwarded authorization (not Envoy ExtAuthz); the requested domain has two additional segments compared to the session domain; two ordered rules exist with inexact domain matches such as *.b.example.com and *.example.com; rules are ordered from most specific to least specific; the second rule is more permissive than the first; and the proxy forwards the original case of the host header. The attacker requests a URL like https://a.B.example.com with capitalization in the second segment.

Root Cause

The root cause is case-sensitive suffix comparison in AccessControlDomainMatcher.IsMatch. Domain names are case-insensitive per [RFC 4343], but the matcher did not canonicalize the input before comparison. This breaks the assumption that rule ordering reflects evaluation priority.

Attack Vector

The attack vector is network-based but requires a specific, discouraged configuration where a bypass or otherwise permissive rule covers a less specific domain than a restrictive rule on a subdomain.

// Patch: internal/authorization/access_control_domain.go
func (m AccessControlDomainMatcher) IsMatch(domain string, subject Subject) (match bool) {
	switch {
	case m.Wildcard:
-		return strings.HasSuffix(domain, m.Name)
+		return utils.StringHasSuffixFold(domain, m.Name)
	case m.UserWildcard:
-		if subject.IsAnonymous() && strings.HasSuffix(domain, m.Name) {
+		if subject.IsAnonymous() && utils.StringHasSuffixFold(domain, m.Name) {
			return len(domain) > len(m.Name)
		}

		return domain == fmt.Sprintf("%s%s", subject.Username, m.Name)
	case m.GroupWildcard:
-		if subject.IsAnonymous() && strings.HasSuffix(domain, m.Name) {
+		if subject.IsAnonymous() && utils.StringHasSuffixFold(domain, m.Name) {
			return len(domain) > len(m.Name)
		}

Source: Authelia commit b6d1d60

The fix introduces a new helper StringHasSuffixFold that performs case-insensitive suffix comparison:

// Patch: internal/utils/strings.go
func StringHasSuffixFold(s, suffix string) bool {
	return len(s) >= len(suffix) && strings.EqualFold(s[len(s)-len(suffix):], suffix)
}

Source: Authelia commit b6d1d60

Detection Methods for CVE-2026-48794

Indicators of Compromise

Authelia authorization logs showing successful policy decisions for hosts containing uppercase characters in subdomain segments, particularly the second-level segment.
Requests to multi-segment subdomains (e.g., a.B.example.com) that resolve to a bypass or more permissive policy than expected.
Reverse proxy access logs preserving original mixed-case Host or X-Forwarded-Host header values.

Detection Strategies

Audit Authelia configuration for ordered wildcard rules where a less specific rule is more permissive than a more specific one.
Replay representative requests against the authorization endpoint with capitalized host segments and compare policy decisions to lowercase equivalents.
Inspect proxy configuration (NGINX, Traefik, HAProxy, Caddy) to confirm whether the host header is canonicalized before being passed to Authelia.

Monitoring Recommendations

Forward Authelia access control decisions and proxy access logs to a centralized log platform and alert on mixed-case host values reaching the authorization endpoint.
Track Authelia version inventory across deployments and flag any instances running 4.36.0 through 4.39.19.
Correlate authentication events with downstream application access to identify policy decisions that diverge from expected rule precedence.

How to Mitigate CVE-2026-48794

Immediate Actions Required

Upgrade Authelia to version 4.39.20 or later, which contains the case-insensitive matching fix.
Review access control rule sets and remove configurations where a bypass policy covers domains also governed by stricter subdomain rules, a pattern long discouraged by Authelia maintainers.
Configure the upstream reverse proxy to lowercase the host header before forwarding it to Authelia's authorization endpoint.

Patch Information

The fix is included in Authelia 4.39.20 via commit b6d1d60baa02f216fdb19f5dfeaf2e805829508a. The patch replaces case-sensitive strings.HasSuffix calls in the domain matcher with a new StringHasSuffixFold helper that uses strings.EqualFold. See the Authelia GHSA-j748-h363-wqj8 advisory for full details.

Workarounds

Switch the integration to Envoy ExtAuthz, which is not affected by this issue.
Restructure access control rules so that hosts intended to bypass authorization are not also covered by overlapping wildcard rules.
Add proxy-layer host canonicalization to enforce lowercase hostnames before authorization checks.

bash

# NGINX example: canonicalize Host header to lowercase before forwarding to Authelia
map $host $host_lower {
    default $host;
    "~^(?<lower>.+)$" $lower;
}

location /api/verify {
    proxy_set_header Host $host_lower;
    proxy_set_header X-Forwarded-Host $host_lower;
    proxy_pass http://authelia:9091;
}