CVE-2025-24806: 
vulnerability analysis and mitigation

Authelia, an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal, was found to have a vulnerability (CVE-2025-24806) discovered in February 2025. The vulnerability affects versions prior to 4.38.19 and 4.39.0, where the regulation system treats username-based and email-based login events separately, effectively doubling the regulation limitations (GitHub Advisory).

The vulnerability stems from the regulation system's records and counting process using the method utilized for sign-in rather than the effective username attribute. When users are allowed to sign in via both username and email, the system treats these as separate login events, potentially doubling the regulation limitations. However, due to the effective operation of regulation where no user-facing sign of their regulation ban is visible either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination or an effective ban blocking the attempt (GitHub Advisory). The vulnerability has been assigned a CVSS v4.0 score of 2.3 (Low) with the vector string: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.

The vulnerability has a minimal impact on account security, though this impact is increased in scenarios where two-factor authentication is not required and weak passwords are used. The primary consequence is that it becomes slightly easier to brute-force a password due to the doubled regulation limitations (GitHub Advisory).

A patch for this issue has been applied to versions 4.38.19 and 4.39.0. Users are advised to upgrade to these versions. For users unable to upgrade, two workarounds are recommended: 1) Do not heavily modify the default settings in a way that results in shorter or less frequent regulation bans, as the default settings effectively mitigate any potential for this issue to be exploited, and 2) Disable the ability for users to login via an email address (GitHub Advisory).