Is CVE-2026-48794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48794 being exploited in the wild.

How severe is CVE-2026-48794?

Medium severity, with a CVSS score of 4, published 19 June 2026.

Which products and versions are affected?

Authelia >= 4.36.0, = 4.36.0, = 4.36.0, <= 4.39.19, SEMVER:introduced=4.36.0,fixed=4.39.20.

Is there a fix for CVE-2026-48794?

Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48794 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48794?

Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48794: Authelia incorrect authorization via improper domain canonicalization

Q: Is there a fix for CVE-2026-48794?

Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48794 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48794?

Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48794 · Severity: medium · CVSS 4 · Published 2026-06-19

Authelia, an open-source authentication and authorization server, contains a flaw where specific access control rules might be bypassed under rare conditions. In certain configurations involving wildcard domains and mixed-case URLs, a user might be granted access based on a less restrictive rule than intended, such as requiring only one-factor authentication instead of two-factor. This could lead to unauthorized access to protected resources if an attacker identifies a vulnerable configuration.

Technologies: github.com/authelia/authelia (Go), github.com/authelia/authelia/v4 (Go). Vendors: Go.

Quick answers

Is CVE-2026-48794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48794 being exploited in the wild.
How severe is CVE-2026-48794?: Medium severity, with a CVSS score of 4, published 19 June 2026.
Which products and versions are affected?: Authelia >= 4.36.0, < 4.39.20, >= 4.36.0, <= 4.39.19; github.com/authelia/authelia (Go) SEMVER:introduced=0; github.com/authelia/authelia/v4 (Go) >= 4.36.0, <= 4.39.19, SEMVER:introduced=4.36.0,fixed=4.39.20.
Is there a fix for CVE-2026-48794?: Yes. github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48794 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48794?: Check whether you run Authelia, github.com/authelia/authelia (Go) or github.com/authelia/authelia/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/authelia/authelia/v4 (Go): upgrade to 4.39.20 or later
```
go get github.com/authelia/authelia/v4@v4.39.20
```

Technical details

An access control rule mismatch exists in Authelia due to a lack of domain canonicalization (CWE-178) when processing forwarded authorization requests. The vulnerability occurs when a request uses mixed-case characters in a specific domain segment (e.g., a.B.example.com) and the configuration contains overlapping wildcard rules ordered from most specific to least specific. If the proxy does not normalize the host header before forwarding to Authelia, the more specific rule may be skipped, causing the engine to evaluate a subsequent, potentially more permissive rule (CWE-863). This requires a highly specific configuration where the session domain is two segments shorter than the requested domain and the integration is not Envoy ExtAuthz. The issue is fixed in version 4.39.20.

Affected products

Authelia Authelia >= 4.36.0, <= 4.39.19

Identifiers

CVE-2026-48794
GHSA-j748-h363-wqj8
GO-2026-5819

Timeline

2026-05-26: disclosed
2026-06-19: advisory: NVD publication date
2026-06-26: patched: GitHub Advisory published/updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.