CVE-2026-33525: 
NixOS vulnerability analysis and mitigation

CVE-2026-33525 is a Cross-Site Scripting (XSS) vulnerability in Authelia, an open-source authentication and authorization server, affecting exclusively version 4.39.15. The flaw arises from improper neutralization of the language cookie value when rendering the HTML login page template, potentially allowing an attacker to inject malicious JavaScript. It was published by the Authelia maintainer on March 21, 2026, and added to the GitHub Advisory Database on March 24, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 weighted score of 0.5 (Low), reflecting the highly conditional nature of exploitation (Github Advisory, Authelia Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting): Authelia 4.39.15 fails to sanitize the value of the language cookie before embedding it into the server-rendered HTML login page template. Exploitation requires a chain of preconditions: (1) the administrator must have deliberately weakened or removed the default Content Security Policy (CSP) — specifically both script-src and connect-src directives must permit unsafe inline scripts and arbitrary connections; (2) a co-hosted application on the same or a parent domain must have its own exploitable vulnerability allowing an attacker to write an arbitrary language cookie scoped to the Authelia domain; and (3) a victim user must visit the Authelia login page after the malicious cookie has been set. The default CSP configuration in Authelia makes exploitation completely impossible without deliberate misconfiguration (Github Advisory, Authelia Advisory).

If all exploitation conditions are met, an attacker could inject and execute arbitrary JavaScript in the context of a victim's browser session on the Authelia login page, resulting in low-level confidentiality and integrity impacts to both the vulnerable and subsequent systems. Potential consequences include session token theft, credential harvesting via login page manipulation, or redirection to attacker-controlled infrastructure. Availability is not impacted, and the practical blast radius is narrow given the multiple hard prerequisites required (Github Advisory, Authelia Advisory).

No public proof-of-concept exploit exists that does not require manual browser manipulation (e.g., installing a userscript or browser extension), which the advisory characterizes as effectively a local attack. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (6th percentile), indicating a very low probability of exploitation in the near term (Github Advisory, Authelia Advisory).

The primary remediation is to upgrade Authelia to version 4.39.16 (or downgrade to 4.39.14), both of which do not contain this bug. For the overwhelming majority of deployments using the default CSP configuration, no action is required, as the default policy makes exploitation impossible. Administrators who have customized the csp_template setting should revert it to the safe default (empty string: server.headers.csp_template: '' or AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE=) and avoid using unsafe-inline, unsafe-eval, or unsafe-hashes in any CSP directives (Github Advisory, Authelia Advisory).

The advisory was authored and published by Authelia maintainer james-d-elliott, who emphasized a "security first ethos" as the motivation for disclosing a theoretical vulnerability with no known PoC. The maintainer noted that discovery of this flaw prompted a broader internal audit of similar issues, which yielded no additional findings, and that additional CSP hardening measures were proactively added. Community reaction has been minimal given the low severity and highly conditional exploitability (Authelia Advisory).