Security Fixes This release contains important security fixes. We encourage users to update as soon as practical. The following advisories accompany this release: Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 Missing Username Canonicalization in Basic Auth when using LDAP reported by @N…
Bug Fixes authentication: cache miss in edge case (#11541) (2df41dd) by @james-d-elliott authentication: fix ldapv3 version check (#11454) (f24ef6b) by @atoerien authorization: amr consistency (#11637) (4c92b2a) by @james-d-elliott handlers: recovered deref panic for otc (#11500) (1cc0d3d) by @james-d-elliott middlewares: stricter domain matching (#11685) (675d8b7) by @james-d-elliott ntp: use ful…
Security Fixes This release fixes security issues. For more information please see GHSA-gmfg-3v4q-9qr4. Bug Fixes authentication: discovery check too strict (#11350) (5c1633b), closes #10840 by @james-d-elliott authentication: excessive filter escape (#11285) (10f7603), closes #11284 by @james-d-elliott configuration: max retries default (#11173) (f29bb95) by @james-d-elliott disable npm scripts f…
4.39.15 (2025-11-29) Bug Fixes authentication: error determining ldap server health (#10753) (b6e14c7) by @james-d-elliott configuration: defaults not applied to server authz (#10793) (73bee22) by @james-d-elliott New Contributors @rowanarts made their first contribution in #10652 @mayswind made their first contribution in #10723 Docker Container docker pull authelia/authelia:4.39.15 docker pull g…
4.39.14 (2025-11-09) Bug Fixes authentication: ldap pool deadlock (#10527) (279c1be), closes #9936 #10392 by @james-d-elliott authentication: referrals not chased (#10608) (5ddb457), closes #10569 by @james-d-elliott authentication: remove singleflight debug logging (#10628) (4c1c6ee) by @Crowley723 expression: shallow value resolution (#10582) (bc0fb6c), closes #10558 by @james-d-elliott New Cont…
4.39.13 (2025-10-12) Bug Fixes authentication: basic auth cache multi-flight (#10522) (e25b66c) by @james-d-elliott regulation: pool deadline error incorrectly logged (#10521) (4b45d48) by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.13 docker pull ghcr.io/authelia/authelia:4.39.13
4.39.12 (2025-10-08) Bug Fixes storage: oauth2 device code constraints (#10484) (26f3b89), closes #10404 by @james-d-elliott Docker Container docker pull authelia/authelia:4.39.12 docker pull ghcr.io/authelia/authelia:4.39.12
4.39.11 (2025-10-01) Bug Fixes handlers: webauthn experimental 2fa default redirection (#10426) (8c76ea3) by @nightah oidc: remember consent ignored (#10384) (5cd17eb) by @james-d-elliott web: consent remember ux (#10347) (e9a4047) by @james-d-elliott New Contributors @gene1wood made their first contribution in #10340 Docker Container docker pull authelia/authelia:4.39.11 docker pull ghcr.io/authe…
Bug Fixes duo: remove incorrect response code check for successful api calls (#11723) (310844b) by @Crowley723 Docker Container docker pull authelia/authelia:4.39.18 docker pull ghcr.io/authelia/authelia:4.39.18
Bug Fixes handlers: oauth2 inconsistent error messages (#11745) (dcae991) by @james-d-elliott middlewares: issuer domain suffix check (#11758) (c6c8c0c) by @james-d-elliott middlewares: misleading issuer error (#11749) (6ceeb2c) by @james-d-elliott server: healthcheck env written late (#11639) (d259426) by @james-d-elliott New Contributors @Phur3ouZ made their first contribution in #11736 @ishanja…