Detections
Analytics

SCA: security update for github.com/authelia/authelia/v4 (GHSA-gmfg-3v4q-9qr4)

low Tenable Self-Hosted Container Security Plugin ID 439142

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Authelia is an open-source authentication and authorization server providing two-factor authentication and
 single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be
 able to inject javascript into the Authelia login page if several conditions are met simultaneously.
 Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for
 this to have a meaningful impact. However if both of these are and they are done so without consideration
 to their potential impact; there is a are situations where this vulnerability could be exploited. This is
 caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This
 vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed
 but it should not be considered impossible. The additional requirement to identify the secondary
 application is however likely to be significantly harder to identify along side this, but also likely
 easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The
 overwhelming majority of installations will not be affected and no workarounds are necessary. The default
 value for the Content Security Policy makes exploiting this weakness completely impossible. It's only
 possible via the deliberate removal of the Content Security Policy or deliberate inclusion of clearly
 noted unsafe policies. (CVE-2026-33525)

Solution

Update the github.com/authelia/authelia/v4 library and its related packages to version 4.39.16 or later.

See Also

https://github.com/advisories/GHSA-gmfg-3v4q-9qr4

Plugin Details

Severity: Low

ID: 439142

Version: Revision 1.67

Type: Local

Family: SCA Checks

Published: 3/24/2026

Updated: 7/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-33525

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.1

Threat Score: 0.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/24/2026

Vulnerability Publication Date: 3/24/2026

Reference Information

CVE: CVE-2026-33525

cwe: CWE-79