Executive brief
Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting in github.com/authelia/authelia
Affected products
- Go github.com/authelia/authelia/v4
- Go github.com/authelia/authelia
Junglewise Threat Intelligence
CVE-2026-33525: GO-2026-4818 - Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting in github.com/authelia/autheli
CVE-2026-33525 · Severity: medium · CVSS 4 · Published 2026-03-26
Technologies: github.com/authelia/authelia/v4 (Go), github.com/authelia/authelia (Go). Vendors: Go.
Related threats
- Authelia incorrect authorization via improper domain canonicalization
- Authelia improper username canonicalization in Basic Auth
- GO-2025-3468 - Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia
- GO-2024-2744 - Access control change may take longer than expected in github.com/authelia/authelia/v4
- Authelia's Group Changes may not have the expected results (YAML file backend)