Starstruk Logo MarkStarstruk

v4.39.20

opensandbox-group/OpenSandboxv4.39.20May 26, 2026by autheliabot

AI Summary

A critical security-focused release addressing vulnerabilities in access control rules and basic authentication, alongside various bug fixes for OAuth2 and metrics.

Key Highlights

  • Fixed security advisory for domain canonicalization in access control rules
  • Fixed missing username canonicalization in Basic Auth when using LDAP

New Features

  • Security fixes for edge case access control
  • LDAP username canonicalization
  • OAuth2 client credentials handling fixes
  • Metrics collection improvements

Full Release Notes

## Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

- [Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization](https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8) reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 
- [Missing Username Canonicalization in Basic Auth when using LDAP ](https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj) reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 

### Bug Fixes

* **authentication:** incorrect bind mode ([#12094](https://github.com/authelia/authelia/issues/12094)) ([dc1d1d6](https://github.com/authelia/authelia/commit/dc1d1d6f1fa59890565fd06d94e6007414b4a465)) by @james-d-elliott
* **authorization:** case-insensitive domain matching [security] ([#12169](https://github.com/authelia/authelia/issues/12169)) ([b6d1d60](https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a)) by @james-d-elliott
* **authorization:** oauth2 client credentials considered anonymous ([#12141](https://github.com/authelia/authelia/issues/12141)) ([54de0c9](https://github.com/authelia/authelia/commit/54de0c9b783a946882673b4d6b85ac9d85157573)) by @james-d-elliott
* **configuration:** add default attributes to freeipa ([#12155](https://github.com/authelia/authelia/issues/12155)) ([f8203be](https://github.com/authelia/authelia/commit/f8203beb780c79dbbd15b010fd473c4478699ff0)) by @kaysond
* **configuration:** include specific warning about ports ([#12145](https://github.com/authelia/authelia/issues/12145)) ([033533e](https://github.com/authelia/authelia/commit/033533ec9a60152544b77fd3534670b43e6158e1)) by @james-d-elliott
* **configuration:** preserve dots in map key names during koanf remap ([#11803](https://github.com/authelia/authelia/issues/11803)) ([211a4cd](https://github.com/authelia/authelia/commit/211a4cd1a4ac27a994dc70523e09a75e7064f95b)) by @nightah
* **expression:** add missing extensions ([#11226](https://github.com/authelia/authelia/issues/11226)) ([4c7ffd3](https://github.com/authelia/authelia/commit/4c7ffd348c484f282e0828144e0ac46bf150a5c3)) by @james-d-elliott
* **handlers:** basic auth username canonicalization [security] ([#12170](https://github.com/authelia/authelia/issues/12170)) ([b8985b5](https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad)) by @james-d-elliott
* **handlers:** hoist issuer checks ([#12160](https://github.com/authelia/authelia/issues/12160)) ([ab5dca7](https://github.com/authelia/authelia/commit/ab5dca7329f9cb0567bfa10895c703cc1e2458e8)) by @james-d-elliott
* **metrics:** ensure unknown bans are measured ([#11999](https://github.com/authelia/authelia/issues/11999)) ([3adae90](https://github.com/authelia/authelia/commit/3adae9081c41032986c7dfabb74b3202a6359927)), closes [#11972](https://github.com/authelia/authelia/issues/11972) by @james-d-elliott
* **metrics:** go collectors not registered ([#11894](https://github.com/authelia/authelia/issues/11894)) ([9cd8812](https://github.com/authelia/authelia/commit/9cd88129ee98c2a757ccc1aa18e8b73dcc46d64c)) by @james-d-elliott
* **middlewares:** add rate limit exclusions ([#12159](https://github.com/authelia/authelia/issues/12159)) ([17397cd](https://github.com/authelia/authelia/commit/17397cdceceef0482b98c9bcad12dc8aef874405)) by @james-d-elliott
* **session:** add startup check for backend connectivity ([#12157](https://github.com/authelia/authelia/issues/12157)) ([8149b6f](https://github.com/authelia/authelia/commit/8149b6fd06ee9cfa0ba0277974eb7834263dfc2a)) by @nightah
* **storage:** harden one-time code consumption ([#12095](https://github.com/authelia/authelia/issues/12095)) ([9dc3eb6](https://github.com/authelia/authelia/commit/9dc3eb6d97a4a84457817a0b49f64aed85f5200f)) by @james-d-elliott
* **storage:** incorrect query used for auth code by req id ([#12139](https://github.com/authelia/authelia/issues/12139)) ([dc6365d](https://github.com/authelia/authelia/commit/dc6365dea566e192513a7679521ef792a9cc14d5)) by @james-d-elliott
* **web:** quote peer dependency versions in pnpm-workspace ([#12049](https://github.com/authelia/authelia/issues/12049)) ([1fb10aa](https://github.com/authelia/authelia/commit/1fb10aa82dd83c1454d6f6172ec32fbd1f7d2149)), closes [#12032](https://github.com/authelia/authelia/issues/12032) by @nightah

### New Contributors
* @nicomem made their first contribution in https://github.com/authelia/authelia/pull/11885
* @TanguyBaudrin made their first contribution in https://github.com/authelia/authelia/pull/11750
* @turtleinarock made their first contribution in https://github.com/authelia/authelia/pull/11912
* @rpadovani made their first contribution in https://github.com/authelia/authelia/pull/11720
* @arylatt made their first contribution in https://github.com/authelia/authelia/pull/11899
* @dubwoc made their first contribution in https://github.com/authelia/authelia/pull/11933

### Docker Container
* `docker pull authelia/authelia:4.39.20`
* `docker pull ghcr.io/authelia/authelia:4.39.20`