CVE-2026-48794: Authelia has an Edge Case Access Control Rule Mismatch

June 26, 2026

Due to lack of canonicalization of domains in very specific edge cases an access control rule may be skipped when it should match a request.

References

github.com/advisories/GHSA-j748-h363-wqj8
github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a
github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8
nvd.nist.gov/vuln/detail/CVE-2026-48794

Code Behaviors & Features

Detect and mitigate CVE-2026-48794 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →