CVE-2026-33525 Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting
Attackers can inject JavaScript into the login page if Content Security Policy is disabled, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33525?
CVE-2026-33525 is a low-severity cross-site scripting vulnerability in authelia, published on 26 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be affected and no workarounds are necessary. The default value for the Content Security Policy makes exploiting this weakness completely impossible. It's only possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly noted unsafe policies.
Weakness: CWE-79
Which versions are affected by CVE-2026-33525?
4 open source packages ship an affected version, including github.com/authelia/authelia/v4 and github.com/authelia/authelia. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/authelia/authelia/v4 Go | From 4.39.15 | 4.39.16 |
github.com/authelia/authelia/v4 Go | From 4.39.15 | 4.39.16 |
github.com/authelia/authelia/v4 Go | From 4.39.15 | 4.39.16 |
github.com/authelia/authelia Go | All versions | None |
Products include Authelia Authelia.
How do I fix CVE-2026-33525?
Upgrade github.com/authelia/authelia/v4 to 4.39.16 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33525 being exploited?
There is no known exploitation of CVE-2026-33525 in the wild and no public exploit code.
Other vulnerabilities in authelia
Sources
Also known as GHSA-gmfg-3v4q-9qr4, GO-2026-4818.