# Authelia v4.39.16

- Product: Authelia (https://whatsnew.fyi/product/authelia)
- Vendor: Authelia
- Date: 2026-03-14
- Version: v4.39.16
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.16
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.16

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix security issues detailed in GHSA-gmfg-3v4q-9qr4
- **fixed** — Authentication discovery check too strict
- **fixed** — Authentication excessive filter escape
- **fixed** — Configuration max retries default
- **fixed** — Disable npm scripts for docker dev build
- **fixed** — Ignore node modules for vite watchers
- **fixed** — Improve root directory finding
- **fixed** — Middlewares strip path incorrect match criteria
- **fixed** — OIDC jwt profile claims policy hydration
- **fixed** — Server sanitise language cookie
- **fixed** — Web UI stuck state enrolling 2fa

###### Security Fixes

This release fixes security issues. For more information please see GHSA-gmfg-3v4q-9qr4.

###### Bug Fixes

* **authentication:** discovery check too strict ([#11350](https://github.com/authelia/authelia/issues/11350)) ([5c1633b](https://github.com/authelia/authelia/commit/5c1633b767f28675cbcc3c7d723e9865fd506b80)), closes [#10840](https://github.com/authelia/authelia/issues/10840) by @james-d-elliott
* **authentication:** excessive filter escape ([#11285](https://github.com/authelia/authelia/issues/11285)) ([10f7603](https://github.com/authelia/authelia/commit/10f7603eb89ac0ca1bff1c8917a96e9c40900c01)), closes [#11284](https://github.com/authelia/authelia/issues/11284) by @james-d-elliott
* **configuration:** max retries default ([#11173](https://github.com/authelia/authelia/issues/11173)) ([f29bb95](https://github.com/authelia/authelia/commit/f29bb95e1040a9d19e8cd558e992456b24912737)) by @james-d-elliott
* disable npm scripts for docker dev build ([#11044](https://github.com/authelia/authelia/issues/11044)) ([4da3c53](https://github.com/authelia/authelia/commit/4da3c53b40b575105ff904ce193bf3f906f6e78c)) by @Crowley723
* ignore node modules for vite watchers ([#11412](https://github.com/authelia/authelia/issues/11412)) ([c8070f2](https://github.com/authelia/authelia/commit/c8070f283b6c593e8d6cca04f5810fd7dc515d08)) by @Crowley723
* improve root directory finding ([#11029](https://github.com/authelia/authelia/issues/11029)) ([d4529e3](https://github.com/authelia/authelia/commit/d4529e3899f007a25af0f4a739cc422c7e99f9db)) by @Crowley723
* **middlewares:** strip path incorrect match criteria ([#11402](https://github.com/authelia/authelia/issues/11402)) ([75a3b99](https://github.com/authelia/authelia/commit/75a3b99033f6530f0190fe1f42e9517fa40edda1)) by @james-d-elliott
* **oidc:** jwt profile claims policy hydration ([#10663](https://github.com/authelia/authelia/issues/10663)) ([24ee120](https://github.com/authelia/authelia/commit/24ee1205fc9ce9afbbed3c5b2bd4bb0b9c2e27cf)) by @james-d-elliott
* **server:** sanitise language cookie ([#11341](https://github.com/authelia/authelia/issues/11341)) ([ed66b2b](https://github.com/authelia/authelia/commit/ed66b2b2ce14a296e1aa654562caa53acfe4b860)) by @nightah
* **web:** ui stuck state enrolling 2fa ([#11367](https://github.com/authelia/authelia/issues/11367)) ([52f01f2](https://github.com/authelia/authelia/commit/52f01f2fa75d9ddacd40873168d76c4e74ea21a2)), closes [#10859](https://github.com/authelia/authelia/issues/10859) by @Br1an67

###### New Contributors
* @kapec94 made their first contribution in https://github.com/authelia/authelia/pull/10841
* @n0rad made their first contribution in https://github.com/authelia/authelia/pull/10854
* @fortellerq made their first contribution in https://github.com/authelia/authelia/pull/11001
* @caiocdcs made their first contribution in https://github.com/authelia/authelia/pull/11045
* @spomata made their first contribution in https://github.com/authelia/authelia/pull/10999
* @xaabi6 made their first contribution in https://github.com/authelia/authelia/pull/11081
* @TheSander562 made their first contribution in https://github.com/authelia/authelia/pull/10899
* @moedtm made their first contribution in https://github.com/authelia/authelia/pull/10896
* @AlexViridi made their first contribution in https://github.com/authelia/authelia/pull/11130
* @tonyaellie made their first contribution in https://github.com/authelia/authelia/pull/11187
* @kiaraly made their first contribution in https://github.com/authelia/authelia/pull/11176
* @louisonsarlinmagnus made their first contribution in https://github.com/authelia/authelia/pull/11210
* @x0k made their first contribution in https://github.com/authelia/authelia/pull/11227
* @tomaszduda23 made their first contribution in https://github.com/authelia/authelia/pull/11225
* @wischi-chr made their first contribution in https://github.com/authelia/authelia/pull/9867
* @FlorianObermayer made their

_[Truncated at 4000 characters — full notes: https://github.com/authelia/authelia/releases/tag/v4.39.16]_