Authelia

Developer Tools

An authentication and authorization server providing SSO and 2FA for your applications.

Latest v4.39.20 · by AutheliaWebsiteauthelia/authelia

Release activity

Release activity — 10 releases across 10 days since Oct 1, 2025. Each cell is one day; darker means more releases that day. Nothing is recorded before Oct 1, 2025. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 20261 release on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
WednesdayNo releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Oct 1, 2025

Changelog

v4.39.20

Fixed 15
  • Fix incorrect bind mode in authentication
  • Implement case-insensitive domain matching in authorization
  • Fix oauth2 client credentials being considered anonymous
  • Add default attributes to freeipa configuration
  • Include specific warning about ports in configuration
  • Preserve dots in map key names during koanf remap
Security 2
  • Fix edge case access control rule domain miss due to lack of canonicalization
  • Fix missing username canonicalization in basic auth when using LDAP
Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

Bug Fixes
  • authentication: incorrect bind mode (#12094) (dc1d1d6) by @james-d-elliott
  • authorization: case-insensitive domain matching [security] (#12169) (b6d1d60) by @james-d-elliott
  • authorization: oauth2 client credentials considered anonymous (#12141) (54de0c9) by @james-d-elliott
  • configuration: add default attributes to freeipa (#12155) (f8203be) by @kaysond
  • configuration: include specific warning about ports (#12145) (033533e) by @james-d-elliott
  • configuration: preserve dots in map key names during koanf remap (#11803) (211a4cd) by @nightah
  • expression: add missing extensions (#11226) (4c7ffd3) by @james-d-elliott
  • handlers: basic auth username canonicalization [security] (#12170) (b8985b5) by @james-d-elliott
  • handlers: hoist issuer checks (#12160) (ab5dca7) by @james-d-elliott
  • metrics: ensure unknown bans are measured (#11999) (3adae90), closes #11972 by @james-d-elliott
  • metrics: go collectors not registered (#11894) (9cd8812) by @james-d-elliott
  • middlewares: add rate limit exclusions (#12159) (17397cd) by @james-d-elliott
  • session: add startup check for backend connectivity (#12157) (8149b6f) by @nightah
  • storage: harden one-time code consumption (#12095) (9dc3eb6) by @james-d-elliott
  • storage: incorrect query used for auth code by req id (#12139) (dc6365d) by @james-d-elliott
  • web: quote peer dependency versions in pnpm-workspace (#12049) (1fb10aa), closes #12032 by @nightah
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.20
  • docker pull ghcr.io/authelia/authelia:4.39.20
View originalPermalink
How v4.39.20 went

v4.39.19

Fixed 4
  • OAuth2 inconsistent error messages in handlers
  • Issuer domain suffix check in middlewares
  • Misleading issuer error in middlewares
  • Healthcheck environment variable written late in server
Bug Fixes
  • handlers: oauth2 inconsistent error messages (#11745) (dcae991) by @james-d-elliott
  • middlewares: issuer domain suffix check (#11758) (c6c8c0c) by @james-d-elliott
  • middlewares: misleading issuer error (#11749) (6ceeb2c) by @james-d-elliott
  • server: healthcheck env written late (#11639) (d259426) by @james-d-elliott
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.19
  • docker pull ghcr.io/authelia/authelia:4.39.19
View originalPermalink
How v4.39.19 went

v4.39.18

Fixed 1
  • Remove incorrect response code check for successful Duo API calls
Bug Fixes
  • duo: remove incorrect response code check for successful api calls (#11723) (310844b) by @Crowley723
Docker Container
  • docker pull authelia/authelia:4.39.18
  • docker pull ghcr.io/authelia/authelia:4.39.18
View originalPermalink
How v4.39.18 went

v4.39.17

Changed 1
  • Make OIDC rate limits configurable
Fixed 6
  • Fix authentication cache miss in edge case
  • Fix LDAPv3 version check
  • Fix authorization AMR consistency
  • Recover deref panic for OTC in handlers
  • Implement stricter domain matching in middlewares
  • Use full precision latency calculation in NTP
Bug Fixes
  • authentication: cache miss in edge case (#11541) (2df41dd) by @james-d-elliott
  • authentication: fix ldapv3 version check (#11454) (f24ef6b) by @atoerien
  • authorization: amr consistency (#11637) (4c92b2a) by @james-d-elliott
  • handlers: recovered deref panic for otc (#11500) (1cc0d3d) by @james-d-elliott
  • middlewares: stricter domain matching (#11685) (675d8b7) by @james-d-elliott
  • ntp: use full precision latency calculation (#11644) (ed4c486) by @james-d-elliott
  • oidc: configurable rate limits (#11696) (f66d3bb) by @james-d-elliott
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.17
  • docker pull ghcr.io/authelia/authelia:4.39.17
View originalPermalink
How v4.39.17 went

v4.39.16

Fixed 10
  • Authentication discovery check too strict
  • Authentication excessive filter escape
  • Configuration max retries default
  • Disable npm scripts for docker dev build
  • Ignore node modules for vite watchers
  • Improve root directory finding
Security 1
  • Fix security issues detailed in GHSA-gmfg-3v4q-9qr4
Security Fixes

This release fixes security issues. For more information please see GHSA-gmfg-3v4q-9qr4.

Bug Fixes
  • authentication: discovery check too strict (#11350) (5c1633b), closes #10840 by @james-d-elliott
  • authentication: excessive filter escape (#11285) (10f7603), closes #11284 by @james-d-elliott
  • configuration: max retries default (#11173) (f29bb95) by @james-d-elliott
  • disable npm scripts for docker dev build (#11044) (4da3c53) by @Crowley723
  • ignore node modules for vite watchers (#11412) (c8070f2) by @Crowley723
  • improve root directory finding (#11029) (d4529e3) by @Crowley723
  • middlewares: strip path incorrect match criteria (#11402) (75a3b99) by @james-d-elliott
  • oidc: jwt profile claims policy hydration (#10663) (24ee120) by @james-d-elliott
  • server: sanitise language cookie (#11341) (ed66b2b) by @nightah
  • web: ui stuck state enrolling 2fa (#11367) (52f01f2), closes #10859 by @Br1an67
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.16
  • docker pull ghcr.io/authelia/authelia:4.39.16
View originalPermalink
How v4.39.16 went

v4.39.15

Fixed 2
  • Fix error determining LDAP server health
  • Fix defaults not applied to server authz
4.39.15 (2025-11-29)
Bug Fixes
  • authentication: error determining ldap server health (#10753) (b6e14c7) by @james-d-elliott
  • configuration: defaults not applied to server authz (#10793) (73bee22) by @james-d-elliott
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.15
  • docker pull ghcr.io/authelia/authelia:4.39.15
View originalPermalink
How v4.39.15 went

v4.39.14

Fixed 4
  • Fix LDAP pool deadlock in authentication
  • Fix LDAP referrals not being chased in authentication
  • Remove singleflight debug logging from authentication
  • Fix shallow value resolution in expression evaluation
4.39.14 (2025-11-09)
Bug Fixes
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.14
  • docker pull ghcr.io/authelia/authelia:4.39.14
View originalPermalink
How v4.39.14 went

v4.39.13

Fixed 2
  • Fix basic auth cache multi-flight issue
  • Fix pool deadline error being incorrectly logged in regulation
4.39.13 (2025-10-12)
Bug Fixes
  • authentication: basic auth cache multi-flight (#10522) (e25b66c) by @james-d-elliott
  • regulation: pool deadline error incorrectly logged (#10521) (4b45d48) by @james-d-elliott
Docker Container
  • docker pull authelia/authelia:4.39.13
  • docker pull ghcr.io/authelia/authelia:4.39.13
View originalPermalink
How v4.39.13 went

v4.39.12

Fixed 1
  • oauth2 device code constraints in storage
4.39.12 (2025-10-08)
Bug Fixes
  • storage: oauth2 device code constraints (#10484) (26f3b89), closes #10404 by @james-d-elliott
Docker Container
  • docker pull authelia/authelia:4.39.12
  • docker pull ghcr.io/authelia/authelia:4.39.12
View originalPermalink
How v4.39.12 went

v4.39.11

Fixed 3
  • WebAuthn experimental 2FA default redirection
  • OIDC remember consent ignored
  • Consent remember UX
4.39.11 (2025-10-01)
Bug Fixes
  • handlers: webauthn experimental 2fa default redirection (#10426) (8c76ea3) by @nightah
  • oidc: remember consent ignored (#10384) (5cd17eb) by @james-d-elliott
  • web: consent remember ux (#10347) (e9a4047) by @james-d-elliott
New Contributors
Docker Container
  • docker pull authelia/authelia:4.39.11
  • docker pull ghcr.io/authelia/authelia:4.39.11
View originalPermalink
How v4.39.11 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
GitHub CLI

GitHub command-line tool

GitHub
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion