Detections
Analytics
SCA: security update for github.com/authelia/authelia/v4 (GHSA-m5mf-3963-4x26)
low Tenable Cloud Security Plugin ID 420919
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Authelia is an open-source authentication and authorization server providing two-factor authentication and
single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username
and email the regulation system treats these as separate login events. This leads to the regulation
limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's
important to note that due to the effective operation of regulation where no user-facing sign of their
regulation ban being visible either via timing or via API responses, it's effectively impossible to
determine if a failure occurs due to a bad username password combination, or a effective ban blocking the
attempt which heavily mitigates any form of brute-force. This occurs because the records and counting
process for this system uses the method utilized for sign in rather than the effective username attribute.
This has a minimal impact on account security, this impact is increased naturally in scenarios when there
is no two-factor authentication required and weak passwords are used. This makes it a bit easier to brute-
force a password. A patch for this issue has been applied to versions 4.38.19, and 4.39.0. Users are
advised to upgrade. Users unable to upgrade should 1. Not heavily modify the default settings in a way
that ends up with shorter or less frequent regulation bans. The default settings effectively mitigate any
potential for this issue to be exploited. and 2. Disable the ability for users to login via an email
address. (CVE-2025-24806)
See Also
Plugin Details
Severity: Low
ID: 420919
Version: Revision 1.15
Type: Local
Family: SCA Checks
Published: 2/19/2025
Updated: 6/30/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
Percentile: 96.84
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2025-24806
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2.3
Threat Score: 0.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/19/2025
Vulnerability Publication Date: 2/19/2025
Reference Information
CVE: CVE-2025-24806
cwe: CWE-307