Brute Force Attack Vulnerability in Authelia Authentication Server

CVE-2025-24806

What is CVE-2025-24806?

The Authelia authentication and authorization server presents a vulnerability due to its handling of login events when both username and email are permitted for sign-in. Each method is treated as distinct, resulting in doubled regulation limits that attackers can exploit to attempt brute-force logins. The lack of clear user-facing notifications regarding regulation bans further complicates the identification of failed login attempts. This situation can be exacerbated in environments lacking two-factor authentication and utilizing weak passwords. Affected users are encouraged to upgrade to the latest versions, and those unable to do so should maintain default regulation settings to mitigate exploitation risks.

References