# Authelia changelog

> An authentication and authorization server providing SSO and 2FA for your applications.

- Vendor: Authelia
- Category: Developer Tools
- Official site: https://www.authelia.com
- Tracked by: What's New (https://whatsnew.fyi/product/authelia)
- Harvested from: GitHub (authelia/authelia)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v4.39.20

- Date: 2026-05-26
- Version: v4.39.20
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.20
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.20

- **security** — Fix edge case access control rule domain miss due to lack of canonicalization
- **security** — Fix missing username canonicalization in basic auth when using LDAP
- **fixed** — Fix incorrect bind mode in authentication
- **fixed** — Implement case-insensitive domain matching in authorization
- **fixed** — Fix oauth2 client credentials being considered anonymous
- **fixed** — Add default attributes to freeipa configuration
- **fixed** — Include specific warning about ports in configuration
- **fixed** — Preserve dots in map key names during koanf remap
- **fixed** — Add missing extensions to expression
- **fixed** — Fix hoist issuer checks in handlers
- **fixed** — Ensure unknown bans are measured in metrics
- **fixed** — Fix go collectors not being registered in metrics
- **fixed** — Add rate limit exclusions to middlewares
- **fixed** — Add startup check for backend connectivity in session
- **fixed** — Harden one-time code consumption in storage
- **fixed** — Fix incorrect query used for auth code by request ID in storage
- **fixed** — Quote peer dependency versions in pnpm-workspace for web

##### Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

- [Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization](https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8) reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 
- [Missing Username Canonicalization in Basic Auth when using LDAP ](https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj) reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 

###### Bug Fixes

* **authentication:** incorrect bind mode ([#12094](https://github.com/authelia/authelia/issues/12094)) ([dc1d1d6](https://github.com/authelia/authelia/commit/dc1d1d6f1fa59890565fd06d94e6007414b4a465)) by @james-d-elliott
* **authorization:** case-insensitive domain matching [security] ([#12169](https://github.com/authelia/authelia/issues/12169)) ([b6d1d60](https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a)) by @james-d-elliott
* **authorization:** oauth2 client credentials considered anonymous ([#12141](https://github.com/authelia/authelia/issues/12141)) ([54de0c9](https://github.com/authelia/authelia/commit/54de0c9b783a946882673b4d6b85ac9d85157573)) by @james-d-elliott
* **configuration:** add default attributes to freeipa ([#12155](https://github.com/authelia/authelia/issues/12155)) ([f8203be](https://github.com/authelia/authelia/commit/f8203beb780c79dbbd15b010fd473c4478699ff0)) by @kaysond
* **configuration:** include specific warning about ports ([#12145](https://github.com/authelia/authelia/issues/12145)) ([033533e](https://github.com/authelia/authelia/commit/033533ec9a60152544b77fd3534670b43e6158e1)) by @james-d-elliott
* **configuration:** preserve dots in map key names during koanf remap ([#11803](https://github.com/authelia/authelia/issues/11803)) ([211a4cd](https://github.com/authelia/authelia/commit/211a4cd1a4ac27a994dc70523e09a75e7064f95b)) by @nightah
* **expression:** add missing extensions ([#11226](https://github.com/authelia/authelia/issues/11226)) ([4c7ffd3](https://github.com/authelia/authelia/commit/4c7ffd348c484f282e0828144e0ac46bf150a5c3)) by @james-d-elliott
* **handlers:** basic auth username canonicalization [security] ([#12170](https://github.com/authelia/authelia/issues/12170)) ([b8985b5](https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad)) by @james-d-elliott
* **handlers:** hoist issuer checks ([#12160](https://github.com/authelia/authelia/issues/12160)) ([ab5dca7](https://github.com/authelia/authelia/commit/ab5dca7329f9cb0567bfa10895c703cc1e2458e8)) by @james-d-elliott
* **metrics:** ensure unknown bans are measured ([#11999](https://github.com/authelia/authelia/issues/11999)) ([3adae90](https://github.com/authelia/authelia/commit/3adae9081c41032986c7dfabb74b3202a6359927)), closes [#11972](https://github.com/authelia/authelia/issues/11972) by @james-d-elliott
* **metrics:** go collectors not registered ([#11894](https://github.com/authelia/authelia/issues/11894)) ([9cd8812](https://github.com/authelia/authelia/commit/9cd88129ee98c2a757ccc1aa18e8b73dcc46d64c)) by @james-d-elliott
* **middlewares:** add rate limit exclusions ([#12159](https://github.com/authelia/authelia/issues/12159)) ([17397cd](https://github.com/authelia/authelia/commit/17397cdceceef0482b98c9bcad12dc8aef874405)) by @james-d-elliott
* **session:** add startup check for backend connectivity ([#12157](https://github.com/authelia/authelia/issues/12157)) ([8149b6f](https://github.com/authelia/authelia/commit/8149b6fd06ee9cfa0ba0277974eb7834263dfc2a)) by @nightah
* **storage:** harden one-time code consumption ([#12095](https://github.com/authelia/authelia/issues/12095)) ([9dc3eb6](https://github.com/authelia/authelia/commit/9dc3eb6d97a4a84457817a0b49f64aed85f5200f)) by @james-d-elliott

_[Truncated at 4000 characters — full notes: https://github.com/authelia/authelia/releases/tag/v4.39.20]_

### v4.39.19

- Date: 2026-04-12
- Version: v4.39.19
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.19
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.19

- **fixed** — OAuth2 inconsistent error messages in handlers
- **fixed** — Issuer domain suffix check in middlewares
- **fixed** — Misleading issuer error in middlewares
- **fixed** — Healthcheck environment variable written late in server

###### Bug Fixes

* **handlers:** oauth2 inconsistent error messages ([#11745](https://github.com/authelia/authelia/issues/11745)) ([dcae991](https://github.com/authelia/authelia/commit/dcae9914bf4103f109b1739298ea52fdf420fa97)) by @james-d-elliott
* **middlewares:** issuer domain suffix check ([#11758](https://github.com/authelia/authelia/issues/11758)) ([c6c8c0c](https://github.com/authelia/authelia/commit/c6c8c0c22a5c509b461412d3745bf2fe20dfc422)) by @james-d-elliott
* **middlewares:** misleading issuer error ([#11749](https://github.com/authelia/authelia/issues/11749)) ([6ceeb2c](https://github.com/authelia/authelia/commit/6ceeb2c59ba7ecd11cd36e9631d988e1bdd6526e)) by @james-d-elliott
* **server:** healthcheck env written late ([#11639](https://github.com/authelia/authelia/issues/11639)) ([d259426](https://github.com/authelia/authelia/commit/d2594266d56d3126771847b90f52d6bf11c7c0bf)) by @james-d-elliott

###### New Contributors
* @Phur3ouZ made their first contribution in https://github.com/authelia/authelia/pull/11736
* @ishanjain28 made their first contribution in https://github.com/authelia/authelia/pull/11757

###### Docker Container
* `docker pull authelia/authelia:4.39.19`
* `docker pull ghcr.io/authelia/authelia:4.39.19`

### v4.39.18

- Date: 2026-04-10
- Version: v4.39.18
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.18
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.18

- **fixed** — Remove incorrect response code check for successful Duo API calls

###### Bug Fixes

* **duo:** remove incorrect response code check for successful api calls ([#11723](https://github.com/authelia/authelia/issues/11723)) ([310844b](https://github.com/authelia/authelia/commit/310844b38605f7cbcbfe2b0ce2ae0e078229921b)) by @Crowley723

###### Docker Container
* `docker pull authelia/authelia:4.39.18`
* `docker pull ghcr.io/authelia/authelia:4.39.18`

### v4.39.17

- Date: 2026-04-09
- Version: v4.39.17
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.17
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.17

- **fixed** — Fix authentication cache miss in edge case
- **fixed** — Fix LDAPv3 version check
- **fixed** — Fix authorization AMR consistency
- **fixed** — Recover deref panic for OTC in handlers
- **fixed** — Implement stricter domain matching in middlewares
- **fixed** — Use full precision latency calculation in NTP
- **changed** — Make OIDC rate limits configurable

###### Bug Fixes

* **authentication:** cache miss in edge case ([#11541](https://github.com/authelia/authelia/issues/11541)) ([2df41dd](https://github.com/authelia/authelia/commit/2df41dd6949294151858810ffd8fbc3a1b6931e6)) by @james-d-elliott
* **authentication:** fix ldapv3 version check ([#11454](https://github.com/authelia/authelia/issues/11454)) ([f24ef6b](https://github.com/authelia/authelia/commit/f24ef6b235f5900d6c6f00946a357ad639c46f0c)) by @atoerien
* **authorization:** amr consistency ([#11637](https://github.com/authelia/authelia/issues/11637)) ([4c92b2a](https://github.com/authelia/authelia/commit/4c92b2a537d9eb7a87c88a536208a42a66a45858)) by @james-d-elliott
* **handlers:** recovered deref panic for otc ([#11500](https://github.com/authelia/authelia/issues/11500)) ([1cc0d3d](https://github.com/authelia/authelia/commit/1cc0d3d61160372f90251a059f910e63696d3192)) by @james-d-elliott
* **middlewares:** stricter domain matching ([#11685](https://github.com/authelia/authelia/issues/11685)) ([675d8b7](https://github.com/authelia/authelia/commit/675d8b7d00dfa1740c7a8779bc7256091c37fbcc)) by @james-d-elliott
* **ntp:** use full precision latency calculation ([#11644](https://github.com/authelia/authelia/issues/11644)) ([ed4c486](https://github.com/authelia/authelia/commit/ed4c486356ae2833b9d4c1e416c540485c6576a1)) by @james-d-elliott
* **oidc:** configurable rate limits ([#11696](https://github.com/authelia/authelia/issues/11696)) ([f66d3bb](https://github.com/authelia/authelia/commit/f66d3bb3063484cfce583ec009abffb93376ad2b)) by @james-d-elliott

###### New Contributors
* @atoerien made their first contribution in https://github.com/authelia/authelia/pull/11454
* @gardient made their first contribution in https://github.com/authelia/authelia/pull/11511
* @yarikoptic made their first contribution in https://github.com/authelia/authelia/pull/11612
* @CarrotManMatt made their first contribution in https://github.com/authelia/authelia/pull/11700

###### Docker Container
* `docker pull authelia/authelia:4.39.17`
* `docker pull ghcr.io/authelia/authelia:4.39.17`

### v4.39.16

- Date: 2026-03-14
- Version: v4.39.16
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.16
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.16

- **security** — Fix security issues detailed in GHSA-gmfg-3v4q-9qr4
- **fixed** — Authentication discovery check too strict
- **fixed** — Authentication excessive filter escape
- **fixed** — Configuration max retries default
- **fixed** — Disable npm scripts for docker dev build
- **fixed** — Ignore node modules for vite watchers
- **fixed** — Improve root directory finding
- **fixed** — Middlewares strip path incorrect match criteria
- **fixed** — OIDC jwt profile claims policy hydration
- **fixed** — Server sanitise language cookie
- **fixed** — Web UI stuck state enrolling 2fa

###### Security Fixes

This release fixes security issues. For more information please see GHSA-gmfg-3v4q-9qr4.

###### Bug Fixes

* **authentication:** discovery check too strict ([#11350](https://github.com/authelia/authelia/issues/11350)) ([5c1633b](https://github.com/authelia/authelia/commit/5c1633b767f28675cbcc3c7d723e9865fd506b80)), closes [#10840](https://github.com/authelia/authelia/issues/10840) by @james-d-elliott
* **authentication:** excessive filter escape ([#11285](https://github.com/authelia/authelia/issues/11285)) ([10f7603](https://github.com/authelia/authelia/commit/10f7603eb89ac0ca1bff1c8917a96e9c40900c01)), closes [#11284](https://github.com/authelia/authelia/issues/11284) by @james-d-elliott
* **configuration:** max retries default ([#11173](https://github.com/authelia/authelia/issues/11173)) ([f29bb95](https://github.com/authelia/authelia/commit/f29bb95e1040a9d19e8cd558e992456b24912737)) by @james-d-elliott
* disable npm scripts for docker dev build ([#11044](https://github.com/authelia/authelia/issues/11044)) ([4da3c53](https://github.com/authelia/authelia/commit/4da3c53b40b575105ff904ce193bf3f906f6e78c)) by @Crowley723
* ignore node modules for vite watchers ([#11412](https://github.com/authelia/authelia/issues/11412)) ([c8070f2](https://github.com/authelia/authelia/commit/c8070f283b6c593e8d6cca04f5810fd7dc515d08)) by @Crowley723
* improve root directory finding ([#11029](https://github.com/authelia/authelia/issues/11029)) ([d4529e3](https://github.com/authelia/authelia/commit/d4529e3899f007a25af0f4a739cc422c7e99f9db)) by @Crowley723
* **middlewares:** strip path incorrect match criteria ([#11402](https://github.com/authelia/authelia/issues/11402)) ([75a3b99](https://github.com/authelia/authelia/commit/75a3b99033f6530f0190fe1f42e9517fa40edda1)) by @james-d-elliott
* **oidc:** jwt profile claims policy hydration ([#10663](https://github.com/authelia/authelia/issues/10663)) ([24ee120](https://github.com/authelia/authelia/commit/24ee1205fc9ce9afbbed3c5b2bd4bb0b9c2e27cf)) by @james-d-elliott
* **server:** sanitise language cookie ([#11341](https://github.com/authelia/authelia/issues/11341)) ([ed66b2b](https://github.com/authelia/authelia/commit/ed66b2b2ce14a296e1aa654562caa53acfe4b860)) by @nightah
* **web:** ui stuck state enrolling 2fa ([#11367](https://github.com/authelia/authelia/issues/11367)) ([52f01f2](https://github.com/authelia/authelia/commit/52f01f2fa75d9ddacd40873168d76c4e74ea21a2)), closes [#10859](https://github.com/authelia/authelia/issues/10859) by @Br1an67

###### New Contributors
* @kapec94 made their first contribution in https://github.com/authelia/authelia/pull/10841
* @n0rad made their first contribution in https://github.com/authelia/authelia/pull/10854
* @fortellerq made their first contribution in https://github.com/authelia/authelia/pull/11001
* @caiocdcs made their first contribution in https://github.com/authelia/authelia/pull/11045
* @spomata made their first contribution in https://github.com/authelia/authelia/pull/10999
* @xaabi6 made their first contribution in https://github.com/authelia/authelia/pull/11081
* @TheSander562 made their first contribution in https://github.com/authelia/authelia/pull/10899
* @moedtm made their first contribution in https://github.com/authelia/authelia/pull/10896
* @AlexViridi made their first contribution in https://github.com/authelia/authelia/pull/11130
* @tonyaellie made their first contribution in https://github.com/authelia/authelia/pull/11187
* @kiaraly made their first contribution in https://github.com/authelia/authelia/pull/11176
* @louisonsarlinmagnus made their first contribution in https://github.com/authelia/authelia/pull/11210
* @x0k made their first contribution in https://github.com/authelia/authelia/pull/11227
* @tomaszduda23 made their first contribution in https://github.com/authelia/authelia/pull/11225
* @wischi-chr made their first contribution in https://github.com/authelia/authelia/pull/9867
* @FlorianObermayer made their

_[Truncated at 4000 characters — full notes: https://github.com/authelia/authelia/releases/tag/v4.39.16]_

### v4.39.15

- Date: 2025-11-29
- Version: v4.39.15
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.15
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.15

- **fixed** — Fix error determining LDAP server health
- **fixed** — Fix defaults not applied to server authz

##### [4.39.15](https://github.com/authelia/authelia/compare/v4.39.14...v4.39.15) (2025-11-29)


###### Bug Fixes

* **authentication:** error determining ldap server health ([#10753](https://github.com/authelia/authelia/issues/10753)) ([b6e14c7](https://github.com/authelia/authelia/commit/b6e14c75b2528b19f45a4659d4b6b91c3f7657c7)) by @james-d-elliott
* **configuration:** defaults not applied to server authz ([#10793](https://github.com/authelia/authelia/issues/10793)) ([73bee22](https://github.com/authelia/authelia/commit/73bee22caf2513fc9d3628506e22fb52ed66a7d2)) by @james-d-elliott

###### New Contributors
* @rowanarts made their first contribution in https://github.com/authelia/authelia/pull/10652
* @mayswind made their first contribution in https://github.com/authelia/authelia/pull/10723

###### Docker Container
* `docker pull authelia/authelia:4.39.15`
* `docker pull ghcr.io/authelia/authelia:4.39.15`

### v4.39.14

- Date: 2025-11-09
- Version: v4.39.14
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.14
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.14

- **fixed** — Fix LDAP pool deadlock in authentication
- **fixed** — Fix LDAP referrals not being chased in authentication
- **fixed** — Remove singleflight debug logging from authentication
- **fixed** — Fix shallow value resolution in expression evaluation

##### [4.39.14](https://github.com/authelia/authelia/compare/v4.39.13...v4.39.14) (2025-11-09)


###### Bug Fixes

* **authentication:** ldap pool deadlock ([#10527](https://github.com/authelia/authelia/issues/10527)) ([279c1be](https://github.com/authelia/authelia/commit/279c1bee78d44b4e8721dc76042da543364c83d1)), closes [#9936](https://github.com/authelia/authelia/issues/9936) [#10392](https://github.com/authelia/authelia/issues/10392) by @james-d-elliott
* **authentication:** referrals not chased ([#10608](https://github.com/authelia/authelia/issues/10608)) ([5ddb457](https://github.com/authelia/authelia/commit/5ddb4578a4ef2f6bfe857d4e659280669303dbdc)), closes [#10569](https://github.com/authelia/authelia/issues/10569) by @james-d-elliott
* **authentication:** remove singleflight debug logging ([#10628](https://github.com/authelia/authelia/issues/10628)) ([4c1c6ee](https://github.com/authelia/authelia/commit/4c1c6ee5d6fd38e082d997ee1833aecb6a785ade)) by @Crowley723
* **expression:** shallow value resolution ([#10582](https://github.com/authelia/authelia/issues/10582)) ([bc0fb6c](https://github.com/authelia/authelia/commit/bc0fb6c7104f91769d3ec5bc0c1f2e68d051d141)), closes [#10558](https://github.com/authelia/authelia/issues/10558) by @james-d-elliott

###### New Contributors
* @Allexio made their first contribution in https://github.com/authelia/authelia/pull/10615
* @sohnemann made their first contribution in https://github.com/authelia/authelia/pull/10629
* @rachelf42 made their first contribution in https://github.com/authelia/authelia/pull/10534
* @jagg2 made their first contribution in https://github.com/authelia/authelia/pull/10688

###### Docker Container
* `docker pull authelia/authelia:4.39.14`
* `docker pull ghcr.io/authelia/authelia:4.39.14`

### v4.39.13

- Date: 2025-10-12
- Version: v4.39.13
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.13
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.13

- **fixed** — Fix basic auth cache multi-flight issue
- **fixed** — Fix pool deadline error being incorrectly logged in regulation

##### [4.39.13](https://github.com/authelia/authelia/compare/v4.39.12...v4.39.13) (2025-10-12)


###### Bug Fixes

* **authentication:** basic auth cache multi-flight ([#10522](https://github.com/authelia/authelia/issues/10522)) ([e25b66c](https://github.com/authelia/authelia/commit/e25b66cce6fd9572e82b760029ada71b33e3e245)) by @james-d-elliott
* **regulation:** pool deadline error incorrectly logged ([#10521](https://github.com/authelia/authelia/issues/10521)) ([4b45d48](https://github.com/authelia/authelia/commit/4b45d48d3c0e737241e95776a4271763527eabb2)) by @james-d-elliott

###### Docker Container
* `docker pull authelia/authelia:4.39.13`
* `docker pull ghcr.io/authelia/authelia:4.39.13`

### v4.39.12

- Date: 2025-10-08
- Version: v4.39.12
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.12
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.12

- **fixed** — oauth2 device code constraints in storage

##### [4.39.12](https://github.com/authelia/authelia/compare/v4.39.11...v4.39.12) (2025-10-08)


###### Bug Fixes

* **storage:** oauth2 device code constraints ([#10484](https://github.com/authelia/authelia/issues/10484)) ([26f3b89](https://github.com/authelia/authelia/commit/26f3b89bd305365b193541d518b1ce47480d5de3)), closes [#10404](https://github.com/authelia/authelia/issues/10404) by @james-d-elliott

###### Docker Container
* `docker pull authelia/authelia:4.39.12`
* `docker pull ghcr.io/authelia/authelia:4.39.12`

### v4.39.11

- Date: 2025-10-01
- Version: v4.39.11
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.11
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.11

- **fixed** — WebAuthn experimental 2FA default redirection
- **fixed** — OIDC remember consent ignored
- **fixed** — Consent remember UX

##### [4.39.11](https://github.com/authelia/authelia/compare/v4.39.10...v4.39.11) (2025-10-01)


###### Bug Fixes

* **handlers:** webauthn experimental 2fa default redirection ([#10426](https://github.com/authelia/authelia/issues/10426)) ([8c76ea3](https://github.com/authelia/authelia/commit/8c76ea3a7b7f4db864dfd51fbb1f93a3c56285f6)) by @nightah
* **oidc:** remember consent ignored ([#10384](https://github.com/authelia/authelia/issues/10384)) ([5cd17eb](https://github.com/authelia/authelia/commit/5cd17eb1cbf9a5249c11c41805036313a4dfdf19)) by @james-d-elliott
* **web:** consent remember ux ([#10347](https://github.com/authelia/authelia/issues/10347)) ([e9a4047](https://github.com/authelia/authelia/commit/e9a404771c50d49e069d25fd88c03971500ffda8)) by @james-d-elliott

###### New Contributors
* @gene1wood made their first contribution in https://github.com/authelia/authelia/pull/10340

###### Docker Container
* `docker pull authelia/authelia:4.39.11`
* `docker pull ghcr.io/authelia/authelia:4.39.11`