Authelia applies regulation separately to Username-based logins to Email-based logins

CVE-2025-24806 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Summary

If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to the effective operation of regulation where no user-facing sign of their regulation ban being visible either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination, or a effective ban blocking the attempt which heavily mitigates any form of brute-force.

Details

This occurs because the records and counting process for this system uses the method utilized for sign in rather than the effective username attribute.

Impact

This has a minimal impact on account security, this impact is increased naturally in scenarios when there is no two-factor authentication required and weak passwords are used. This makes it a bit easier to brute-force a password.

Workarounds

  1. Do not heavily modify the default settings in a way that ends up with shorter or less frequent regulation bans. The default settings effectively mitigate any potential for this issue to be exploited.
  2. Disable the ability for users to login via an email address.

Basic information

Type
reviewed
Severity
low
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2025-02-19 17:47:47 UTC
Updated
2025-02-19 20:00:07 UTC
GitHub reviewed
2025-02-19 17:47:47 UTC
NVD published
2025-02-19

EPSS Score

Score Percentile
0.12% 31.48%

CVSS Scores

Base score Version Severity Vector
2.3 4.0 —
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:H)
Exploitation depends on constrained or hard-to-reproduce conditions.
Attack requirements (AT:P)
Additional preconditions must be present for exploitation.
Privileges required (PR:L)
Low privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:N)
No confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:L)
Limited integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:N)
No availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N)
No availability impact on subsequent systems.

Identifiers

Type Value
GHSA GHSA-m5mf-3963-4x26 ↗
CVE CVE-2025-24806 ↗

CWEs

CWE id Name
CWE-307 Improper Restriction of Excessive Authentication Attempts

Credits

  • tsschaffert (reporter)
  • Ahrdie (reporter)
  • caesarakalaeii (reporter)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go github.com/authelia/authelia/v4 < 4.38.19 4.38.19 —

References

cvelogic Threat Intelligence