CVE-2026-47203
- Source
- https://cve.org/CVERecord?id=CVE-2026-47203
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47203.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47203
- Aliases
- Published
- 2026-06-19T20:19:47.903Z
- Modified
- 2026-07-08T08:13:39.689117093Z
- Severity
-
- 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- Authelia Missing Username Canonicalization in Basic Auth (LDAP)
- Details
-
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the
Authorizationheader with theBasicscheme) on the authz verification endpoint, Authelia takes the username directly from theAuthorizationheader and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively :john,John, andJOHNall bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism. - Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47203.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-178", "CWE-307" ] }- References