# Authelia v4.39.20

- Product: Authelia (https://whatsnew.fyi/product/authelia)
- Vendor: Authelia
- Date: 2026-05-26
- Version: v4.39.20
- Original notes: https://github.com/authelia/authelia/releases/tag/v4.39.20
- Permalink: https://whatsnew.fyi/product/authelia/releases/v4.39.20

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix edge case access control rule domain miss due to lack of canonicalization
- **security** — Fix missing username canonicalization in basic auth when using LDAP
- **fixed** — Fix incorrect bind mode in authentication
- **fixed** — Implement case-insensitive domain matching in authorization
- **fixed** — Fix oauth2 client credentials being considered anonymous
- **fixed** — Add default attributes to freeipa configuration
- **fixed** — Include specific warning about ports in configuration
- **fixed** — Preserve dots in map key names during koanf remap
- **fixed** — Add missing extensions to expression
- **fixed** — Fix hoist issuer checks in handlers
- **fixed** — Ensure unknown bans are measured in metrics
- **fixed** — Fix go collectors not being registered in metrics
- **fixed** — Add rate limit exclusions to middlewares
- **fixed** — Add startup check for backend connectivity in session
- **fixed** — Harden one-time code consumption in storage
- **fixed** — Fix incorrect query used for auth code by request ID in storage
- **fixed** — Quote peer dependency versions in pnpm-workspace for web

##### Security Fixes

This release contains important security fixes. We encourage users to update as soon as practical.

The following advisories accompany this release:

- [Edge Case Access Control Rule Domain Miss Due to Lack of Canonicalization](https://github.com/authelia/authelia/security/advisories/GHSA-j748-h363-wqj8) reported by @j0hndo, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 
- [Missing Username Canonicalization in Basic Auth when using LDAP ](https://github.com/authelia/authelia/security/advisories/GHSA-hjj4-hfjm-fmrj) reported by @Nadav0077, fixed by @james-d-elliott, reviewed by @nightah and @Crowley723 

###### Bug Fixes

* **authentication:** incorrect bind mode ([#12094](https://github.com/authelia/authelia/issues/12094)) ([dc1d1d6](https://github.com/authelia/authelia/commit/dc1d1d6f1fa59890565fd06d94e6007414b4a465)) by @james-d-elliott
* **authorization:** case-insensitive domain matching [security] ([#12169](https://github.com/authelia/authelia/issues/12169)) ([b6d1d60](https://github.com/authelia/authelia/commit/b6d1d60baa02f216fdb19f5dfeaf2e805829508a)) by @james-d-elliott
* **authorization:** oauth2 client credentials considered anonymous ([#12141](https://github.com/authelia/authelia/issues/12141)) ([54de0c9](https://github.com/authelia/authelia/commit/54de0c9b783a946882673b4d6b85ac9d85157573)) by @james-d-elliott
* **configuration:** add default attributes to freeipa ([#12155](https://github.com/authelia/authelia/issues/12155)) ([f8203be](https://github.com/authelia/authelia/commit/f8203beb780c79dbbd15b010fd473c4478699ff0)) by @kaysond
* **configuration:** include specific warning about ports ([#12145](https://github.com/authelia/authelia/issues/12145)) ([033533e](https://github.com/authelia/authelia/commit/033533ec9a60152544b77fd3534670b43e6158e1)) by @james-d-elliott
* **configuration:** preserve dots in map key names during koanf remap ([#11803](https://github.com/authelia/authelia/issues/11803)) ([211a4cd](https://github.com/authelia/authelia/commit/211a4cd1a4ac27a994dc70523e09a75e7064f95b)) by @nightah
* **expression:** add missing extensions ([#11226](https://github.com/authelia/authelia/issues/11226)) ([4c7ffd3](https://github.com/authelia/authelia/commit/4c7ffd348c484f282e0828144e0ac46bf150a5c3)) by @james-d-elliott
* **handlers:** basic auth username canonicalization [security] ([#12170](https://github.com/authelia/authelia/issues/12170)) ([b8985b5](https://github.com/authelia/authelia/commit/b8985b57b70acdff8f204ed426ff619e763461ad)) by @james-d-elliott
* **handlers:** hoist issuer checks ([#12160](https://github.com/authelia/authelia/issues/12160)) ([ab5dca7](https://github.com/authelia/authelia/commit/ab5dca7329f9cb0567bfa10895c703cc1e2458e8)) by @james-d-elliott
* **metrics:** ensure unknown bans are measured ([#11999](https://github.com/authelia/authelia/issues/11999)) ([3adae90](https://github.com/authelia/authelia/commit/3adae9081c41032986c7dfabb74b3202a6359927)), closes [#11972](https://github.com/authelia/authelia/issues/11972) by @james-d-elliott
* **metrics:** go collectors not registered ([#11894](https://github.com/authelia/authelia/issues/11894)) ([9cd8812](https://github.com/authelia/authelia/commit/9cd88129ee98c2a757ccc1aa18e8b73dcc46d64c)) by @james-d-elliott
* **middlewares:** add rate limit exclusions ([#12159](https://github.com/authelia/authelia/issues/12159)) ([17397cd](https://github.com/authelia/authelia/commit/17397cdceceef0482b98c9bcad12dc8aef874405)) by @james-d-elliott
* **session:** add startup check for backend connectivity ([#12157](https://github.com/authelia/authelia/issues/12157)) ([8149b6f](https://github.com/authelia/authelia/commit/8149b6fd06ee9cfa0ba0277974eb7834263dfc2a)) by @nightah
* **storage:** harden one-time code consumption ([#12095](https://github.com/authelia/authelia/issues/12095)) ([9dc3eb6](https://github.com/authelia/authelia/commit/9dc3eb6d97a4a84457817a0b49f64aed85f5200f)) by @james-d-elliott

_[Truncated at 4000 characters — full notes: https://github.com/authelia/authelia/releases/tag/v4.39.20]_