LoginSign Up
← Back to all sparks
A

Authelia

INFRA · APIS
Velocity5.0

Open-source authentication and two-factor authorization server.

www.authelia.com ↗

Authelia patches two access control bypass paths from canonicalization gaps.

authenticationssooidcsecurityself-hostedopen-source
◆Current state
Authelia v4.39.x is in a sustained hardening cycle: a critical security release in May fixed two authentication bypass paths, and subsequent patch releases have worked through a dense queue of OIDC protocol compliance bugs — resource indicators, client credentials foreign key handling, authentication strategy configuration, and resource strategy matching. The pace of micro-patches (v4.39.21 through v4.39.25 in a two-week window) reflects active production use surfacing edge cases.
◆Where it's heading
The OIDC fix pattern is deliberate: Authelia is closing gaps in the parts of OAuth 2.0/OIDC that enterprise clients actually use — resource indicators, client credentials grants, pooled authentication. This isn't maintenance drift; it's building toward a more complete OIDC server for complex multi-client deployments. The access control canonicalization fix from May signals a broader audit of how Authelia normalizes domain names and usernames before authorization decisions.
◆Prediction
The OIDC compliance fixes in v4.39.x are groundwork for new grant types and flows in a future major version. Expect device authorization flow or Pushed Authorization Requests (PAR) to appear in a v4.40 or v5.x roadmap entry once the protocol surface is cleaned up.

◆Recent moves

  1. 2d ago

    v4.39.25

    v4.39.25 fixes SMTP handling of IPv6 literal addresses — a narrow bug affecting deployments that route notification emails through IPv6-only SMTP servers. No user-visible impact for the vast majority of setups.

    View source ↗
  2. 3d ago

    v4.39.24

    v4.39.24 fixes internal test suite output — log color preservation and test group formatting. Pure developer experience, zero user-visible change.

    View source ↗
  3. 4d ago

    Five OIDC protocol fixes in v4.39.23

    v4.39.23 addresses five distinct OIDC issues: client auth config strategy resolution, client credentials subject foreign key violations, resource indicators grant handling, resource strategy matching, and a storage unbound query. These aren't cosmetic — they affect clients that rely on resource indicators or client credentials grants, both common in enterprise OAuth deployments.

    View source ↗
  4. 9d ago

    v4.39.22

    v4.39.22 fixes an access token JWT upgrade path in storage. A single targeted fix with no user-visible behavioral change under normal operation.

    View source ↗
  5. 9d ago

    Multi-area hardening: LDAP auth, OIDC, and API endpoint fixes in v4.39.21

    v4.39.21 is a dense patch release covering LDAP authentication (pooled client handling, stale user aliases, unnecessary read locks), OIDC (configurable rate limits, AMR consistency), and API endpoint gaps. The breadth — fixes across authentication, authorization, configuration, and OIDC in a single release — reflects a backlog flush rather than a single targeted bug.

    View source ↗
  6. 3mo ago

    Authelia patches two access control bypass paths: domain miss and LDAP username canonicalization

    ⚡ SPARK

    v4.39.20 is a security release fixing two distinct bypass paths: an access control rule domain miss from missing canonicalization, and a username canonicalization gap in Basic Auth with LDAP. Both are authorization failures — not just edge-case behavior — that allowed access to resources the rules should have blocked. The fixes affect any deployment using LDAP and domain-based access control rules.

    View source ↗