x/vulndb: potential Go vuln in github.com/authelia/authelia/v4: GHSA-m5mf-3963-4x26

[GoVulnBot]

Advisory GHSA-m5mf-3963-4x26 references a vulnerability in the following Go modules:

Module
github.com/authelia/authelia
github.com/authelia/authelia/v4

Description:

Summary

If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to the effective operation of regulation where no user-facing sign of their regulation ban being visible either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination, or a effective ban blocking the attempt which heavily...

References:

• ADVISORY: GHSA-m5mf-3963-4x26
• ADVISORY: GHSA-m5mf-3963-4x26
• FIX: authelia/authelia@d4a5418

Cross references:

• github.com/authelia/authelia/v4 appears in 3 other report(s):
  • data/excluded/GO-2022-0917.yaml (x/vulndb: potential Go vuln in github.com/authelia/authelia/v4: CVE-2021-32637, GHSA-68wm-pfjf-wqp6 #917) NOT_IMPORTABLE
  • data/excluded/GO-2023-1638.yaml (x/vulndb: potential Go vuln in github.com/authelia/authelia/v4: GHSA-36f2-fcrx-fp4j #1638) NOT_IMPORTABLE
  • data/reports/GO-2024-2744.yaml (x/vulndb: potential Go vuln in github.com/authelia/authelia/v4: GHSA-x883-2vmg-xwf7 #2744)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/authelia/authelia
      vulnerable_at: 3.16.2+incompatible
    - module: github.com/authelia/authelia/v4
      versions:
        - fixed: 4.38.19
      vulnerable_at: 4.38.18
summary: |-
    Authelia applies regulation separately to Username-based logins to Email-based
    logins in github.com/authelia/authelia
cves:
    - CVE-2025-24806
ghsas:
    - GHSA-m5mf-3963-4x26
references:
    - advisory: https://github.com/advisories/GHSA-m5mf-3963-4x26
    - advisory: https://github.com/authelia/authelia/security/advisories/GHSA-m5mf-3963-4x26
    - fix: https://github.com/authelia/authelia/commit/d4a54189aa6563912f9427b96dcb01eacafa785c
source:
    id: GHSA-m5mf-3963-4x26
    created: 2025-02-19T18:01:36.956378444Z
review_status: UNREVIEWED