Is CVE-2026-47203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47203 being exploited in the wild.

How severe is CVE-2026-47203?

Medium severity, with a CVSS score of 4, published 19 June 2026.

Which products and versions are affected?

Authelia >= 4.38.0, = 4.38.0, = 4.38.0, <= 4.39.19, SEMVER:introduced=4.38.0,fixed=4.39.20.

Is there a fix for CVE-2026-47203?

Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47203 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-47203?

Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47203: Authelia improper username canonicalization in Basic Auth

Q: Is there a fix for CVE-2026-47203?

Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47203 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-47203?

Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47203 · Severity: medium · CVSS 4 · Published 2026-06-19

Authelia is an open-source tool that provides secure login and single sign-on (SSO) for web applications. A security flaw in how it handles usernames during 'Basic Auth' logins could allow an attacker to bypass brute-force protections. By slightly changing the capitalization of a username (e.g., 'User' vs 'user'), an attacker can reset the login attempt counter, making it easier to guess passwords without being blocked.

Technologies: github.com/authelia/authelia (Go), github.com/authelia/authelia/v4 (Go). Vendors: Go.

Quick answers

Is CVE-2026-47203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47203 being exploited in the wild.
How severe is CVE-2026-47203?: Medium severity, with a CVSS score of 4, published 19 June 2026.
Which products and versions are affected?: Authelia >= 4.38.0, < 4.39.20, >= 4.38.0, <= 4.39.19; github.com/authelia/authelia (Go) SEMVER:introduced=0; github.com/authelia/authelia/v4 (Go) >= 4.38.0, <= 4.39.19, SEMVER:introduced=4.38.0,fixed=4.39.20.
Is there a fix for CVE-2026-47203?: Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47203 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-47203?: Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later
```
go get github.com/authelia/authelia/v4@v4.39.20
```

Technical details

A vulnerability exists in Authelia's 'authz' verification endpoint when Basic Authentication is used in conjunction with an LDAP backend. While LDAP is case-insensitive for authentication, Authelia's regulation system (which handles rate limiting and bans) treats usernames case-sensitively in its SQL lookups. An attacker can exploit this by submitting the same username with different casing (e.g., 'admin', 'Admin', 'ADMIN'), effectively giving each variation its own 'ban bucket' and bypassing brute-force protections. This issue affects versions 4.38.0 through 4.39.19. It is mitigated if the underlying database uses case-insensitive collation (like some MySQL configurations) or if IP-based regulation is enabled. The fix, introduced in version 4.39.20, implements proper username canonicalization.

Affected products

Authelia Authelia >= 4.38.0, < 4.39.20

Identifiers

CVE-2026-47203
GHSA-hjj4-hfjm-fmrj
GO-2026-5430

Timeline

2026-05-26: patched: Fix committed to repository
2026-06-19: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.