Starstruk Logo MarkStarstruk

v4.39.20

ChangemakerStudios/Papercut-SMTPv4.39.20May 26, 2026by autheliabot

AI Summary

This release addresses critical security vulnerabilities related to access control and username canonicalization in LDAP authentication. It also includes numerous bug fixes for authentication, authorization, and metrics.

Key Highlights

  • Security fixes for edge case access control
  • Fix for missing Username Canonicalization in Basic Auth
  • Fixes for OAuth2 client credentials and basic auth
  • Multiple bug fixes for metrics, storage, and web components

New Features

  • Hardened one-time code consumption
  • Startup checks for backend connectivity

Full Release Notes

## Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

- [Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization](https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8) reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 
- [Missing Username Canonicalization in Basic Auth when using LDAP ](https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj) reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 

### Bug Fixes

* **authentication:** incorrect bind mode ([#12094](https://github.com/authelia/authelia/issues/12094)) ([dc1d1d6](https://github.com/authelia/authelia/commit/dc1d1d6f1fa59890565fd06d94e6007414b4a465)) by @james-d-elliott
* **authorization:** case-insensitive domain matching [security] ([#12169](https://github.com/authelia/authelia/issues/12169)) ([b6d1d60](https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a)) by @james-d-elliott
* **authorization:** oauth2 client credentials considered anonymous ([#12141](https://github.com/authelia/authelia/issues/12141)) ([54de0c9](https://github.com/authelia/authelia/commit/54de0c9b783a946882673b4d6b85ac9d85157573)) by @james-d-elliott
* **configuration:** add default attributes to freeipa ([#12155](https://github.com/authelia/authelia/issues/12155)) ([f8203be](https://github.com/authelia/authelia/commit/f8203beb780c79dbbd15b010fd473c4478699ff0)) by @kaysond
* **configuration:** include specific warning about ports ([#12145](https://github.com/authelia/authelia/issues/12145)) ([033533e](https://github.com/authelia/authelia/commit/033533ec9a60152544b77fd3534670b43e6158e1)) by @james-d-elliott
* **configuration:** preserve dots in map key names during koanf remap ([#11803](https://github.com/authelia/authelia/issues/11803)) ([211a4cd](https://github.com/authelia/authelia/commit/211a4cd1a4ac27a994dc70523e09a75e7064f95b)) by @nightah
* **expression:** add missing extensions ([#11226](https://github.com/authelia/authelia/issues/11226)) ([4c7ffd3](https://github.com/authelia/authelia/commit/4c7ffd348c484f282e0828144e0ac46bf150a5c3)) by @james-d-elliott
* **handlers:** basic auth username canonicalization [security] ([#12170](https://github.com/authelia/authelia/issues/12170)) ([b8985b5](https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad)) by @james-d-elliott
* **handlers:** hoist issuer checks ([#12160](https://github.com/authelia/authelia/issues/12160)) ([ab5dca7](https://github.com/authelia/authelia/commit/ab5dca7329f9cb0567bfa10895c703cc1e2458e8)) by @james-d-elliott
* **metrics:** ensure unknown bans are measured ([#11999](https://github.com/authelia/authelia/issues/11999)) ([3adae90](https://github.com/authelia/authelia/commit/3adae9081c41032986c7dfabb74b3202a6359927)), closes [#11972](https://github.com/authelia/authelia/issues/11972) by @james-d-elliott
* **metrics:** go collectors not registered ([#11894](https://github.com/authelia/authelia/issues/11894)) ([9cd8812](https://github.com/authelia/authelia/commit/9cd88129ee98c2a757ccc1aa18e8b73dcc46d64c)) by @james-d-elliott
* **middlewares:** add rate limit exclusions ([#12159](https://github.com/authelia/authelia/issues/12159)) ([17397cd](https://github.com/authelia/authelia/commit/17397cdceceef0482b98c9bcad12dc8aef874405)) by @james-d-elliott
* **session:** add startup check for backend connectivity ([#12157](https://github.com/authelia/authelia/issues/12157)) ([8149b6f](https://github.com/authelia/authelia/commit/8149b6fd06ee9cfa0ba0277974eb7834263dfc2a)) by @nightah
* **storage:** harden one-time code consumption ([#12095](https://github.com/authelia/authelia/issues/12095)) ([9dc3eb6](https://github.com/authelia/authelia/commit/9dc3eb6d97a4a84457817a0b49f64aed85f5200f)) by @james-d-elliott
* **storage:** incorrect query used for auth code by req id ([#12139](https://github.com/authelia/authelia/issues/12139)) ([dc6365d](https://github.com/authelia/authelia/commit/dc6365dea566e192513a7679521ef792a9cc14d5)) by @james-d-elliott
* **web:** quote peer dependency versions in pnpm-workspace ([#12049](https://github.com/authelia/authelia/issues/12049)) ([1fb10aa](https://github.com/authelia/authelia/commit/1fb10aa82dd83c1454d6f6172ec32fbd1f7d2149)), closes [#12032](https://github.com/authelia/authelia/issues/12032) by @nightah

### New Contributors
* @nicomem made their first contribution in https://github.com/authelia/authelia/pull/11885
* @TanguyBaudrin made their first contribution in https://github.com/authelia/authelia/pull/11750
* @turtleinarock made their first contribution in https://github.com/authelia/authelia/pull/11912
* @rpadovani made their first contribution in https://github.com/authelia/authelia/pull/11720
* @arylatt made their first contribution in https://github.com/authelia/authelia/pull/11899
* @dubwoc made their first contribution in https://github.com/authelia/authelia/pull/11933

### Docker Container
* `docker pull authelia/authelia:4.39.20`
* `docker pull ghcr.io/authelia/authelia:4.39.20`