CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/03/2026 |
| CVE-2025-24806 | LOW2.3 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitat | 19/02/2025 |
| GO-2024-2744 | Access control change may take longer than expected in github.com/authelia/authelia/v4 | 26/04/2024 |
| GHSA-x883-2vmg-xwf7 | LOW1.6 | Authelia's Group Changes may not have the expected results (YAML file backend) | 22/04/2024 |
| CVE-2021-32637 | CRITICAL10.0 | Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, | 28/05/2021 |
| CVE-2021-29456 | MEDIUM5.4 | Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any domain, including p | 21/04/2021 |