Vulnerability-Lookup

CVE-2026-33525 (GCVE-0-2026-33525)

Vulnerability from cvelistv5 – Published: 2026-03-26 19:22 – Updated: 2026-03-30 14:55

Title

Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

Summary

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.

Severity ?

0.5 (Low)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

https://github.com/authelia/authelia/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	authelia	authelia	Affected: = 4.39.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-30T13:59:38.875586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-30T14:55:38.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authelia",
          "vendor": "authelia",
          "versions": [
            {
              "status": "affected",
              "version": "= 4.39.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it\u0027s almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It\u0027s only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 0.5,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T19:22:57.418Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4"
        }
      ],
      "source": {
        "advisory": "GHSA-gmfg-3v4q-9qr4",
        "discovery": "UNKNOWN"
      },
      "title": "Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33525",
    "datePublished": "2026-03-26T19:22:57.418Z",
    "dateReserved": "2026-03-20T18:05:11.830Z",
    "dateUpdated": "2026-03-30T14:55:38.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33525",
      "date": "2026-04-28",
      "epss": "0.00045",
      "percentile": "0.13588"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33525\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-26T20:16:14.740\",\"lastModified\":\"2026-04-02T18:20:55.207\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it\u0027s almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It\u0027s only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.\"},{\"lang\":\"es\",\"value\":\"Authelia es un servidor de autenticaci\u00f3n y autorizaci\u00f3n de c\u00f3digo abierto que proporciona autenticaci\u00f3n de dos factores e inicio de sesi\u00f3n \u00fanico (SSO) para aplicaciones a trav\u00e9s de un portal web. En la versi\u00f3n 4.39.15, un atacante podr\u00eda potencialmente inyectar javascript en la p\u00e1gina de inicio de sesi\u00f3n de Authelia si se cumplen varias condiciones simult\u00e1neamente. A menos que se hayan modificado las directivas \u0027script-src\u0027 y \u0027connect-src\u0027, es casi imposible que esto tenga un impacto significativo. Sin embargo, si ambas lo est\u00e1n y se hacen sin considerar su impacto potencial; hay situaciones en las que esta vulnerabilidad podr\u00eda ser explotada. Esto se debe a la falta de neutralizaci\u00f3n del valor de la cookie \u0027langauge\u0027 al renderizar la plantilla HTML. Es probable que esta vulnerabilidad sea dif\u00edcil de descubrir mediante la toma de huellas digitales debido a la forma en que est\u00e1 dise\u00f1ada Authelia, pero no debe considerarse imposible. El requisito adicional para identificar la aplicaci\u00f3n secundaria, sin embargo, es probable que sea significativamente m\u00e1s dif\u00edcil de identificar junto con esto, pero tambi\u00e9n probablemente m\u00e1s f\u00e1cil de identificar mediante la toma de huellas digitales. Los usuarios deben actualizar a la versi\u00f3n 4.39.16 o degradar a la 4.39.14 para mitigar el problema. La abrumadora mayor\u00eda de las instalaciones no se ver\u00e1n afectadas y no son necesarias soluciones alternativas. El valor predeterminado de la Pol\u00edtica de Seguridad de Contenido (Content Security Policy) hace que explotar esta debilidad sea completamente imposible. Solo es posible mediante la eliminaci\u00f3n deliberada de la Pol\u00edtica de Seguridad de Contenido o la inclusi\u00f3n deliberada de pol\u00edticas inseguras claramente se\u00f1aladas.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":0.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:authelia:authelia:4.39.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD79E7CF-923C-4637-8F3A-E9720511E3AF\"}]}]}],\"references\":[{\"url\":\"https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33525\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-30T13:59:38.875586Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-30T13:59:47.876Z\"}}], \"cna\": {\"title\": \"Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting\", \"source\": {\"advisory\": \"GHSA-gmfg-3v4q-9qr4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 0.5, \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"authelia\", \"product\": \"authelia\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 4.39.15\"}]}], \"references\": [{\"url\": \"https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4\", \"name\": \"https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it\u0027s almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It\u0027s only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-26T19:22:57.418Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33525\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-30T14:55:38.565Z\", \"dateReserved\": \"2026-03-20T18:05:11.830Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-26T19:22:57.418Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33525

Vulnerability from fkie_nvd - Published: 2026-03-26 20:16 - Updated: 2026-04-02 18:20

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	authelia	authelia	4.39.15

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:authelia:authelia:4.39.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD79E7CF-923C-4637-8F3A-E9720511E3AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it\u0027s almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It\u0027s only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies."
    },
    {
      "lang": "es",
      "value": "Authelia es un servidor de autenticaci\u00f3n y autorizaci\u00f3n de c\u00f3digo abierto que proporciona autenticaci\u00f3n de dos factores e inicio de sesi\u00f3n \u00fanico (SSO) para aplicaciones a trav\u00e9s de un portal web. En la versi\u00f3n 4.39.15, un atacante podr\u00eda potencialmente inyectar javascript en la p\u00e1gina de inicio de sesi\u00f3n de Authelia si se cumplen varias condiciones simult\u00e1neamente. A menos que se hayan modificado las directivas \u0027script-src\u0027 y \u0027connect-src\u0027, es casi imposible que esto tenga un impacto significativo. Sin embargo, si ambas lo est\u00e1n y se hacen sin considerar su impacto potencial; hay situaciones en las que esta vulnerabilidad podr\u00eda ser explotada. Esto se debe a la falta de neutralizaci\u00f3n del valor de la cookie \u0027langauge\u0027 al renderizar la plantilla HTML. Es probable que esta vulnerabilidad sea dif\u00edcil de descubrir mediante la toma de huellas digitales debido a la forma en que est\u00e1 dise\u00f1ada Authelia, pero no debe considerarse imposible. El requisito adicional para identificar la aplicaci\u00f3n secundaria, sin embargo, es probable que sea significativamente m\u00e1s dif\u00edcil de identificar junto con esto, pero tambi\u00e9n probablemente m\u00e1s f\u00e1cil de identificar mediante la toma de huellas digitales. Los usuarios deben actualizar a la versi\u00f3n 4.39.16 o degradar a la 4.39.14 para mitigar el problema. La abrumadora mayor\u00eda de las instalaciones no se ver\u00e1n afectadas y no son necesarias soluciones alternativas. El valor predeterminado de la Pol\u00edtica de Seguridad de Contenido (Content Security Policy) hace que explotar esta debilidad sea completamente imposible. Solo es posible mediante la eliminaci\u00f3n deliberada de la Pol\u00edtica de Seguridad de Contenido o la inclusi\u00f3n deliberada de pol\u00edticas inseguras claramente se\u00f1aladas."
    }
  ],
  "id": "CVE-2026-33525",
  "lastModified": "2026-04-02T18:20:55.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 0.5,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T20:16:14.740",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-GMFG-3V4Q-9QR4

Vulnerability from github – Published: 2026-03-24 16:33 – Updated: 2026-03-30 14:07

Summary

Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

Details

Impact

Official Weighted Severity Rating: Low

This exploit is very unlikely to be the case for most users as it requires configuration of the Content Security Policy template value. Below represents a safe value, any other value other than unconfigured should be very carefully evaluated regardless of the fix.

server:
  headers:
    csp_template: ''

AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE=

Provided the following conditions are met:

The Content Security Policy:
1. Has been disabled or modified from the entirely safe default value; and
2. Has been completely disabled by the Administrator by omitting the header explicitly at the proxy (worst practice); or
3. Has been effectively disabled by modifying script-src allowing unsafe inline scripts rather than using hashes AND effectively disabled by modifying connect-src allowing connections to arbitrary websites.
Authelia is being hosted on a domain that has other applications that can write to the cookie for the Authelia domain.
One of the other applications noted in 2 has an vulnerability that can be exploited to execute malicious javascript with similar requirements to 1.
The attacker can exploit the javascript in 3 to delete the existing language cookie scoped to the fully qualified domain name of Authelia with the same site value of strict (which is not possible in most scenarios unless the application in 3 has the exact same domain or a subdomain of the Authelia domain).
The attacker can exploit the javascript in 3 to write a new language cookie scoped for a domain that Authelia is sent cookies for.
The attacker can get a user to meet the conditions required to execute the javascript in 3.
You are running Authelia 4.39.15.

An attacker may potentially be able to inject javascript into the Authelia login page. Unless both the script-src and connect-src directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited.

This is caused to the lack of neutralization of the langauge cookie value when rendering the HTML template.

This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint.

Patches

Upgrade to 4.39.16 or Downgrade to 4.39.14.

Proof of Concept

No current proof of concept exists that does not require manual manipulation of the browser which is effectively a local attack where all privileges have been compromised without the need for this attack vector (i.e. installation of userscripts or a browser plugin which would be able to compromise any website or web app). There is a decent chance one will exist or certain conditions exist that could lead to the vulnerability being exploitable.

Discovery of this flaw has prompted an deliberate evaluation of any other potential flaws similar to this which did not yield any results, as well as a deliberate evaluation of best practices in this area which has resulted in a minor tweak to hardening measures. These additional hardening measures should not have any effect (explicit definition of the script-src and connect-src policies, which are the same value as default was previously), but it should theoretically prevent an accidental change in the future degrading the existing security layers we implement.

Workarounds

The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.

Use the default Content Security Policy

The default Content Security Policy is completely secure and prevents any third party javascript the browser evaluates against it.

server:
  headers:
    csp_template: ''

Using a custom Content Security Policy is a very advanced choice that requires specialist knowledge. The use of unsafe-inline, unsafe-eval, unsafe-hashes, etc. are particularly problematic as they effectively allow arbitrary script execution (if a security policy includes an option that says unsafe it's probably a good indication you should not use it).

Upgrade or Downgrade

Both the next version and previous version of Authelia do not have this bug.

Severity ?

0.5 (Low)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:L/U:Clear

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/authelia/authelia/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.39.15"
            },
            {
              "fixed": "4.39.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.39.15"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-24T16:33:03Z",
    "nvd_published_at": "2026-03-26T20:16:14Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\n**Official Weighted Severity Rating:** Low\n\nThis exploit is very unlikely to be the case for most users as it requires configuration of the Content Security Policy template value. Below represents a safe value, **_any other value_** other than unconfigured should be **_very carefully evaluated_** regardless of the fix.\n\n```yaml\nserver:\n  headers:\n    csp_template: \u0027\u0027\n```\n\n```env\nAUTHELIA_SERVER_HEADERS_CSP_TEMPLATE=\n```\n\nProvided the following conditions are met:\n\n1. The Content Security Policy:\n    1. Has been disabled or modified from the entirely safe default value; and\n    2. Has been completely disabled by the Administrator by omitting the header explicitly at the proxy (worst practice); or\n    3. Has been effectively disabled by modifying `script-src` allowing unsafe inline scripts rather than using hashes AND effectively disabled by modifying `connect-src` allowing connections to arbitrary websites.\n2. Authelia is being hosted on a domain that has other applications that can write to the cookie for the Authelia domain.\n3. One of the other applications noted in 2 has an vulnerability that can be exploited to execute malicious javascript with similar requirements to 1.\n4. The attacker can exploit the javascript in 3 to delete the existing `language` cookie scoped to the fully qualified domain name of Authelia with the same site value of `strict` (which is not possible in most scenarios unless the application in 3 has the exact same domain or a subdomain of the Authelia domain).\n5. The attacker can exploit the javascript in 3 to write a new `language` cookie scoped for a domain that Authelia is sent cookies for.\n6. The attacker can get a user to meet the conditions required to execute the javascript in 3.\n7. You are running Authelia 4.39.15.\n\nAn attacker may potentially be able to inject javascript into the Authelia login page. Unless both the `script-src` and `connect-src` directives have been modified it\u0027s almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited.\n\nThis is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template.\n\nThis vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint.\n\n### Patches\n\nUpgrade to 4.39.16 or Downgrade to 4.39.14.\n\n### Proof of Concept\n\nNo current proof of concept exists that does not require manual manipulation of the browser which is effectively a local attack where all privileges have been compromised without the need for this attack vector (i.e. installation of userscripts or a browser plugin which would be able to compromise any website or web app). There is a decent chance one will exist or certain conditions exist that could lead to the vulnerability being exploitable.\n\nDiscovery of this flaw has prompted an deliberate evaluation of any other potential flaws similar to this which did not yield any results, as well as a deliberate evaluation of best practices in this area which has resulted in a minor tweak to hardening measures. These additional hardening measures should not have any effect (explicit definition of the `script-src` and `connect-src` policies, which are the same value as `default` was previously), but it should theoretically prevent an accidental change in the future degrading the existing security layers we implement.\n\n### Workarounds\n\nThe overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It\u0027s only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.\n\n#### Use the default Content Security Policy\n\nThe default Content Security Policy is completely secure and prevents any third party javascript the browser evaluates against it.\n\n```yaml\nserver:\n  headers:\n    csp_template: \u0027\u0027\n```\n\nUsing a custom Content Security Policy is a very advanced choice that requires specialist knowledge. The use of `unsafe-inline`, `unsafe-eval`, `unsafe-hashes`, etc. are particularly problematic as they effectively allow arbitrary script execution (if a security policy includes an option that says `unsafe` it\u0027s probably a good indication you should not use it).\n\n#### Upgrade or Downgrade\n\nBoth the next version and previous version of Authelia do not have this bug.",
  "id": "GHSA-gmfg-3v4q-9qr4",
  "modified": "2026-03-30T14:07:52Z",
  "published": "2026-03-24T16:33:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33525"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authelia/authelia"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:L/U:Clear",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33525 (GCVE-0-2026-33525)

FKIE_CVE-2026-33525

GHSA-GMFG-3V4Q-9QR4

Impact

Patches

Proof of Concept

Workarounds

Use the default Content Security Policy

Upgrade or Downgrade

Tags

Sightings

Nomenclature