An attacker may inject javascript into the Authelia login page when the application is rendered with an unneutralized language cookie value. The vulnerability is mitigated by the software’s default Content Security Policy (CSP); exploitation requires an attacker to reconfigure or bypass the CSP, a step that is highly unlikely to be performed without direct knowledge of the deployment. Even if the CSP is compromised, the attacker would only gain script execution in the context of the login page, limiting the scope to the authentication interface rather than the entire system.

The vulnerability affects Authelia version 4.39.15. Users running that exact version should either update to 4.39.16 or downgrade to 4.39.14 to eliminate the flaw. No other versions or products are documented as affected.

The CVSS base score of 0.5 and EPSS probability of less than 1% indicate a very low overall risk. The vulnerability is not listed in the CISA KEV catalog, reflecting that no widespread exploitation has been observed. Exploitation is conditional on both an attacker identifying the specific language cookie value injection point and deliberately modifying CSP directives; both conditions together are difficult to achieve in practice, which further reduces the likelihood of real-world attacks.