Listen to this Post
How CVE-2026-48794 Works
Authelia is an open-source authentication and authorization server that provides two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.36.0 through 4.39.19, a lack of domain canonicalization in specific edge cases can cause an access control rule to be skipped when it should match a request.
This vulnerability is triggered by a highly specific combination of conditions. First, the target resource must be using the forwarded authorization integration. The requested domain must have two additional segments compared to the session domain—for example, `a.b.example.com` is requested, but the session domain is example.com. The access control rules must include two separate inexact domain matches, such as `.b.example.com` and .example.com, with wildcards, username matches, or group matches. These rules must be ordered from most specific to least specific, and the second rule must be more permissive than the first.
The attacker must specifically request a URL for the more specific domain where the second part contains one or more capitalized letters—for instance, https://a.B.example.com`—while no other segment has capitalized letters. Additionally, the integration must not be the Envoy ExtAuthz integration, and the proxy must not canonicalize the requested host name in the relevant header before sending it to the authorization endpoint.
This issue is further mitigated by another bug where the session domain would not match if any part of the configured session domain was capitalized, which would prevent the request from succeeding. The kind of configuration that produces this bypass has long been highly discouraged; hosts that should be bypassed entirely should not be secured by having the proxy check them with authorization handlers. The patch is available in version 4.39.20.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Authelia
Version: 4.36.0–4.39.19
Vulnerability: Access Control Bypass
Severity: Low (CVSS 3.1: 3.1)
Date: 2026-06-19
<h2 style="color: blue;">Prediction: Patch: 2026-06-19</h2>
<h2 style="color: blue;">What Undercode Say</h2>
<h2 style="color: blue;">Analytics:</h2>
<h2 style="color: blue;">Check your current Authelia version:</h2>
authelia --version
Verify if your configuration contains the vulnerable rule pattern:
grep -A 5 -B 5 "domain:" /path/to/configuration.yml | grep -E "\\\..\\.."
Search for the specific vulnerable rule order in your access control section:
grep -A 10 "access_control:" /path/to/configuration.yml | grep -E "domain: '\\\\..'"
<h2 style="color: blue;">Exploit</h2>
To exploit this vulnerability, an attacker must send a request with a specific URL format to a server that meets all the conditions. For example, if the session domain is `example.com` and the access control rules are:
access_control: rules: - domain: '.b.example.com' policy: 'two_factor' - domain: '.example.com' policy: 'one_factor'
<h2 style="color: blue;">An attacker could request:</h2>
https://a.B.example.com
Due to the lack of canonicalization, the proxy may not normalize `B` to lowercase, causing the rule for `.b.example.com` to be skipped. The request would then fall through to the more permissive rule `.example.com` (e.g., `one_factor` instead oftwo_factor`), effectively downgrading the authentication requirement.
Protection
To protect against this vulnerability:
1. Upgrade to Authelia version 4.39.20 or later.
- Avoid configurations where a more permissive wildcard rule follows a more specific one, especially with `.example.com` patterns.
- Ensure your proxy canonicalizes the `Host` header before forwarding it to the authorization endpoint.
- Review access control rules and simplify them to reduce the risk of misconfiguration.
Impact
The impact of this vulnerability is limited due to the highly specific conditions required for exploitation. An attacker would need to discover a configuration with the exact rule ordering and domain structure described. If successfully exploited, the attacker could bypass a more restrictive access control rule (e.g., two-factor authentication) and be granted access under a more permissive rule (e.g., one-factor or bypass), leading to unauthorized access to protected resources. The CVSSv3.1 Base Score is 3.1 (Low), reflecting the narrow attack surface and the unlikelihood of widespread exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
