CVE-2026-44649 SillyTavern: Authentication Bypass via SSO Header Injection
Attackers can bypass authentication and gain admin access by injecting SSO headers when SSO is enabled, allowing full control of the SillyTavern instance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44649?
CVE-2026-44649 is a critical authentication bypass vulnerability in SillyTavern, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers to automatically log in users when SSO is configured. There is no validation that these headers originate from a trusted reverse proxy. Any network client that can reach the SillyTavern port directly can inject these headers and authenticate as any user, including administrators, without a password. This vulnerability is exploitable only when sso.autheliaAuth: true or sso.authentikAuth: true is set in config.yaml (both default to false). This vulnerability is fixed in 1.18.0.
Which versions are affected by CVE-2026-44649?
2 open source packages ship an affected version, including sillytavern.
| Package | Affected | Fixed in |
|---|---|---|
sillytavern npm | All versions | 1.18.0 |
sillytavern npm | All versions | 1.18.0 |
How do I fix CVE-2026-44649?
Upgrade sillytavern to 1.18.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44649 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44649 exists.
Sources
Also known as GHSA-gxx6-h3g6-vwjh.