CVE-2026-33525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33525", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T18:05:11.830Z", "datePublished": "2026-03-26T19:22:57.418Z", "dateUpdated": "2026-03-30T14:55:38.565Z"}, "containers": {"cna": {"title": "Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 0.5, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4"}], "affected": [{"vendor": "authelia", "product": "authelia", "versions": [{"version": "= 4.39.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T19:22:57.418Z"}, "descriptions": [{"lang": "en", "value": "Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies."}], "source": {"advisory": "GHSA-gmfg-3v4q-9qr4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T13:59:38.875586Z", "id": "CVE-2026-33525", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T14:55:38.565Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T13:59:38.875586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T13:59:47.876Z"}}], "cna": {"title": "Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting", "source": {"advisory": "GHSA-gmfg-3v4q-9qr4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 0.5, "attackVector": "ADJACENT", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "authelia", "product": "authelia", "versions": [{"status": "affected", "version": "= 4.39.15"}]}], "references": [{"url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4", "name": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T19:22:57.418Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33525", "state": "PUBLISHED", "dateUpdated": "2026-03-30T14:55:38.565Z", "dateReserved": "2026-03-20T18:05:11.830Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T19:22:57.418Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "authelia", "vendor": "authelia", "versions": [{"status": "affected", "version": "= 4.39.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:authelia:authelia:4.39.15:*:*:*:*:*:*:*", "matchCriteriaId": "BD79E7CF-923C-4637-8F3A-E9720511E3AF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies."}, {"lang": "es", "value": "Authelia es un servidor de autenticaci\u00f3n y autorizaci\u00f3n de c\u00f3digo abierto que proporciona autenticaci\u00f3n de dos factores e inicio de sesi\u00f3n \u00fanico (SSO) para aplicaciones a trav\u00e9s de un portal web. En la versi\u00f3n 4.39.15, un atacante podr\u00eda potencialmente inyectar javascript en la p\u00e1gina de inicio de sesi\u00f3n de Authelia si se cumplen varias condiciones simult\u00e1neamente. A menos que se hayan modificado las directivas 'script-src' y 'connect-src', es casi imposible que esto tenga un impacto significativo. Sin embargo, si ambas lo est\u00e1n y se hacen sin considerar su impacto potencial; hay situaciones en las que esta vulnerabilidad podr\u00eda ser explotada. Esto se debe a la falta de neutralizaci\u00f3n del valor de la cookie 'langauge' al renderizar la plantilla HTML. Es probable que esta vulnerabilidad sea dif\u00edcil de descubrir mediante la toma de huellas digitales debido a la forma en que est\u00e1 dise\u00f1ada Authelia, pero no debe considerarse imposible. El requisito adicional para identificar la aplicaci\u00f3n secundaria, sin embargo, es probable que sea significativamente m\u00e1s dif\u00edcil de identificar junto con esto, pero tambi\u00e9n probablemente m\u00e1s f\u00e1cil de identificar mediante la toma de huellas digitales. Los usuarios deben actualizar a la versi\u00f3n 4.39.16 o degradar a la 4.39.14 para mitigar el problema. La abrumadora mayor\u00eda de las instalaciones no se ver\u00e1n afectadas y no son necesarias soluciones alternativas. El valor predeterminado de la Pol\u00edtica de Seguridad de Contenido (Content Security Policy) hace que explotar esta debilidad sea completamente imposible. Solo es posible mediante la eliminaci\u00f3n deliberada de la Pol\u00edtica de Seguridad de Contenido o la inclusi\u00f3n deliberada de pol\u00edticas inseguras claramente se\u00f1aladas."}], "id": "CVE-2026-33525", "lastModified": "2026-06-17T10:37:39.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.5, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33525", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T13:59:38.875586Z", "version": "2.0.3"}}]}, "published": "2026-03-26T20:16:14.740", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/authelia/authelia/security/advisories/GHSA-gmfg-3v4q-9qr4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.39.15"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "authelia", "source": "cna", "vendor": "authelia"}, "product": "authelia", "vendor": "authelia"}], "analysis": {"en": {"generated_at": "2026-04-02T22:15:32.561712+00:00", "value": {"mitigation_remediation": ["Upgrade Authelia to version 4.39.16 or downgrade to 4.39.14."], "summary": {"action": "Apply Patch", "impact": "Cross-site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Authelia version 4.39.15. Users running that exact version should either update to 4.39.16 or downgrade to 4.39.14 to eliminate the flaw. No other versions or products are documented as affected.", "description_and_impact": "An attacker may inject javascript into the Authelia login page when the application is rendered with an unneutralized language cookie value. The vulnerability is mitigated by the software\u2019s default Content Security Policy (CSP); exploitation requires an attacker to reconfigure or bypass the CSP, a step that is highly unlikely to be performed without direct knowledge of the deployment. Even if the CSP is compromised, the attacker would only gain script execution in the context of the login page, limiting the scope to the authentication interface rather than the entire system.", "risk_and_exploitability": "The CVSS base score of 0.5 and EPSS probability of less than 1% indicate a very low overall risk. The vulnerability is not listed in the CISA KEV catalog, reflecting that no widespread exploitation has been observed. Exploitation is conditional on both an attacker identifying the specific language cookie value injection point and deliberately modifying CSP directives; both conditions together are difficult to achieve in practice, which further reduces the likelihood of real-world attacks."}}}}, "created": "2026-03-27T08:33:11.773644+00:00", "updated": "2026-04-03T09:38:54.044660+00:00", "vendors": ["authelia", "authelia$PRODUCT$authelia"]}