Starstruk Logo MarkStarstruk

v4.39.20

elkowar/ewwv4.39.20May 26, 2026by autheliabot

AI Summary

This release addresses critical security vulnerabilities regarding access control rules and username canonicalization in Basic Auth when using LDAP, alongside various stability improvements.

Key Highlights

  • Security fixes for domain access control rule misses and Basic Auth username canonicalization
  • Improved error handling for OAuth2 client credentials and metrics
  • Harden one-time code consumption in storage
  • New contributors joined the project

Full Release Notes

## Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

- [Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization](https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8) reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 
- [Missing Username Canonicalization in Basic Auth when using LDAP ](https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj) reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 

### Bug Fixes

* **authentication:** incorrect bind mode ([#12094](https://github.com/authelia/authelia/issues/12094)) ([dc1d1d6](https://github.com/authelia/authelia/commit/dc1d1d6f1fa59890565fd06d94e6007414b4a465)) by @james-d-elliott
* **authorization:** case-insensitive domain matching [security] ([#12169](https://github.com/authelia/authelia/issues/12169)) ([b6d1d60](https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a)) by @james-d-elliott
* **authorization:** oauth2 client credentials considered anonymous ([#12141](https://github.com/authelia/authelia/issues/12141)) ([54de0c9](https://github.com/authelia/authelia/commit/54de0c9b783a946882673b4d6b85ac9d85157573)) by @james-d-elliott
* **configuration:** add default attributes to freeipa ([#12155](https://github.com/authelia/authelia/issues/12155)) ([f8203be](https://github.com/authelia/authelia/commit/f8203beb780c79dbbd15b010fd473c4478699ff0)) by @kaysond
* **configuration:** include specific warning about ports ([#12145](https://github.com/authelia/authelia/issues/12145)) ([033533e](https://github.com/authelia/authelia/commit/033533ec9a60152544b77fd3534670b43e6158e1)) by @james-d-elliott
* **configuration:** preserve dots in map key names during koanf remap ([#11803](https://github.com/authelia/authelia/issues/11803)) ([211a4cd](https://github.com/authelia/authelia/commit/211a4cd1a4ac27a994dc70523e09a75e7064f95b)) by @nightah
* **expression:** add missing extensions ([#11226](https://github.com/authelia/authelia/issues/11226)) ([4c7ffd3](https://github.com/authelia/authelia/commit/4c7ffd348c484f282e0828144e0ac46bf150a5c3)) by @james-d-elliott
* **handlers:** basic auth username canonicalization [security] ([#12170](https://github.com/authelia/authelia/issues/12170)) ([b8985b5](https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad)) by @james-d-elliott
* **handlers:** hoist issuer checks ([#12160](https://github.com/authelia/authelia/issues/12160)) ([ab5dca7](https://github.com/authelia/authelia/commit/ab5dca7329f9cb0567bfa10895c703cc1e2458e8)) by @james-d-elliott
* **metrics:** ensure unknown bans are measured ([#11999](https://github.com/authelia/authelia/issues/11999)) ([3adae90](https://github.com/authelia/authelia/commit/3adae9081c41032986c7dfabb74b3202a6359927)), closes [#11972](https://github.com/authelia/authelia/issues/11972) by @james-d-elliott
* **metrics:** go collectors not registered ([#11894](https://github.com/authelia/authelia/issues/11894)) ([9cd8812](https://github.com/authelia/authelia/commit/9cd88129ee98c2a757ccc1aa18e8b73dcc46d64c)) by @james-d-elliott
* **middlewares:** add rate limit exclusions ([#12159](https://github.com/authelia/authelia/issues/12159)) ([17397cd](https://github.com/authelia/authelia/commit/17397cdceceef0482b98c9bcad12dc8aef874405)) by @james-d-elliott
* **session:** add startup check for backend connectivity ([#12157](https://github.com/authelia/authelia/issues/12157)) ([8149b6f](https://github.com/authelia/authelia/commit/8149b6fd06ee9cfa0ba0277974eb7834263dfc2a)) by @nightah
* **storage:** harden one-time code consumption ([#12095](https://github.com/authelia/authelia/issues/12095)) ([9dc3eb6](https://github.com/authelia/authelia/commit/9dc3eb6d97a4a84457817a0b49f64aed85f5200f)) by @james-d-elliott
* **storage:** incorrect query used for auth code by req id ([#12139](https://github.com/authelia/authelia/issues/12139)) ([dc6365d](https://github.com/authelia/authelia/commit/dc6365dea566e192513a7679521ef792a9cc14d5)) by @james-d-elliott
* **web:** quote peer dependency versions in pnpm-workspace ([#12049](https://github.com/authelia/authelia/issues/12049)) ([1fb10aa](https://github.com/authelia/authelia/commit/1fb10aa82dd83c1454d6f6172ec32fbd1f7d2149)), closes [#12032](https://github.com/authelia/authelia/issues/12032) by @nightah

### New Contributors
* @nicomem made their first contribution in https://github.com/authelia/authelia/pull/11885
* @TanguyBaudrin made their first contribution in https://github.com/authelia/authelia/pull/11750
* @turtleinarock made their first contribution in https://github.com/authelia/authelia/pull/11912
* @rpadovani made their first contribution in https://github.com/authelia/authelia/pull/11720
* @arylatt made their first contribution in https://github.com/authelia/authelia/pull/11899
* @dubwoc made their first contribution in https://github.com/authelia/authelia/pull/11933

### Docker Container
* `docker pull authelia/authelia:4.39.20`
* `docker pull ghcr.io/authelia/authelia:4.39.20`