Authelia Versions 4.36.0 through 4.39.19 contain a subtle domain canonicalization flaw in the forwarded authorization integration. When a request arrives with a domain that contains two more sub‑segments than the session domain, and the configuration includes two overlapping wildcard domain rules, the implementation can mistakenly evaluate the less specific, more permissive rule before the intended stricter rule. The result is that authentication and authorization checks may be bypassed, allowing an attacker to gain access to protected resources that should otherwise be restricted.

This weakness affects the open‑source Authelia authentication and authorization server, specifically deployments of Authelia 4.36.0 up to 4.39.19. The issue is triggered only when the forwarded authorization integration is used, the proxy does not canonicalize the host header, and the integration is not Envoy ExtAuthz. Systems configured with overlapping wildcard domain matches such as *.b.example.com and *.example.com, arranged from most to least specific, are vulnerable. The configuration pattern is strongly discouraged and is not supported by the default settings.

The CVSS v3.1 score of 1.3 indicates a low overall impact, and the EPSS score is not available, making the likelihood of exploitation uncertain. The exploit requires a highly specific configuration and a crafted request header containing a capital letter in the sub‑domain, making remote exploitation complex and unlikely in practice. The vulnerability is not listed in CISA’s KEV catalog. If the conditions are satisfied, an attacker could elevate privileges by bypassing access controls, but this is not straightforward and the opportunity is narrow.