This vulnerability stems from Authelia's handling of Basic Auth usernames when the user is authenticated against an LDAP backend. The system consumes the raw username from the Authorization header and forwards it to the regulation subsystem without case‑normalisation. LDAP treats usernames as case‑insensitive, whereas the SQL queries that record bans and attempts treat them as case‑sensitive in certain contexts. Consequently, each case variation of a username creates or references a separate ban bucket, allowing an attacker to circumvent login throttling or account lockouts by simply altering the case of their credentials.

Affected versions are Authelia 4.38.0 through 4.39.19. The issue exists where Basic Authentication is enabled and the verification endpoint is used in an environment that exchanges credentials with an LDAP server. Updates to version 4.39.20 include a patch that normalises usernames before they are processed by the regulation logic, fixing the mismatch.

The CVSS score of 2.9 indicates a low‑severity problem; no known exploitation of remote code execution or high privilege escalation is reported. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the verification endpoint and the ability to send authenticated requests; they could then repeatedly attempt logins with varied casing to avoid bans, but they would still need valid credentials. The practical impact is a limited bypass of policy enforcement rather than a broad compromise of the system.