Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting
Date: 2026-03
Affected: go/github.com/authelia/authelia/v4
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-33525
CWE: CWE-79

### Impact **Official Weighted Severity Rating:** Low This exploit is very unlikely to be the case for most users as it requires configuration of the Content Security Policy template value. Below represents a safe value, **_any other value_** other than unconfigured should be **_very carefully evaluated_** regardless of the fix. ```yaml server: headers: csp_template: '' ``` ```env AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE= ``` Provided the following conditions are met: 1. The Content Security Policy: 1. Has been disabled or modified from the entirely safe default value; and 2. Has been completely disabled by the Administrator by omitting the header explicitly at the proxy (worst practice); or 3. Has been effectively disabled by modifying `script-src` allowing unsafe inline scripts rather than using hashes AND effectively disabled by modifying `connect-src` allowing connections to arbitrary websites. 2. Authelia is being hosted on a domain that has other applications that can write to the cookie for the Authelia domain. 3. One of the other applications noted in 2 has an vulnerability that can be exploited to execute malicious javascript with similar requirements to 1. 4. The attacker can exploit the javascript in 3 to delete the existing `language` cookie scoped to the fully qualified domain name of Authelia with the same site value of `strict` (which is not possible in most scenarios unless the application in 3 has the exact same domain or a subdomain of th


Mitigations:

Architectural layers (MAESTRO):