{"id":"CVE-2026-47203","aliases":["GHSA-hjj4-hfjm-fmrj","GO-2026-5430"],"url":"https://o3.security/vulnerability/CVE-2026-47203","summary":"Authelia Missing Username Canonicalization in Basic Auth (LDAP)","details":"Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.","published":"2026-06-19T20:19:47.903Z","modified":"2026-08-12T03:51:21.091917878Z","cvss":null,"epss":{"score":0.00453,"percentile":0.37392,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/authelia/authelia/v4","fixedVersion":"4.39.20"}],"fix":{"url":"https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad","label":"authelia/authelia@b8985b5"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47203.json"},{"type":"ADVISORY","url":"https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47203"},{"type":"FIX","url":"https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.091917878Z"}}