Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-29456: Authelia versions 4.27.4 and earlier allow unauthorized redirects

CVE-2021-29456 · published 5 years ago

Summary

Using Authelia's 2-factor authentication and single sign-on, attackers can trick users into visiting malicious websites. This doesn't affect the security of your application directly, but it's still a concern. To mitigate this, use a reverse proxy to remove the malicious redirect, or update to version 4.28.0.

What to do

Update github.com authelia to version 4.28.0.
Update authelia authelia to version 4.28.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	authelia	< 4.28.0 Fix: upgrade to 4.28.0
–	authelia	authelia	< 4.28.0 `cpe:2.3:a:authelia:authelia::::::::`

Original advisory text

Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any domain, including potentially malicious sites. This security issue does not directly impact the security of the web application itself. As a workaround, one can use a reverse proxy to strip the query parameter from the affected endpoint. There is a patch for version 4.28.0.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-601Open Redirect

Timeline

Published21 Apr 2021

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-36f2-fcrx-fp4j · GHSA

CVE-2021-29456 · NVD

Track software like this

Free during beta