CVE-2021-32637
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAuthelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially support except nginx do not allow malformed URI paths. The problem is rectified entirely in v4.29.3. As this patch is relatively straightforward we can back port this to any version upon request. Alternatively we are supplying a git patch to 4.25.1 which should be relatively straightforward to apply to any version, the git patches for specific versions can be found in the references. The most relevant workaround is upgrading. You can also add a block which fails requests that contains a malformed URI in the internal location block.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAuthelia authentication bypass vulnerability where malformed HTTP requests can circumvent the authentication mechanism when using nginx's ngx_http_auth_request_module. The vulnerability stems from improper handling of malformed URI paths in the authentication flow.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 4.0.0, < 4.25.1>= 4.26.0, < 4.29.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Authelia versionRun 'authelia version' or check the container image/tag, or inspect the binary versionAffected if The installed version is >= 4.0.0 and < 4.25.1, OR >= 4.26.0 and < 4.29.3
-
Verify nginx auth_request configurationInspect nginx configuration files for 'auth_request' directive pointing to Authelia backendAffected if nginx is configured to use auth_request module with Authelia as the authentication endpoint
-
Check for internal location blockReview nginx configuration for the location block that handles Authelia authentication requests (typically the internal endpoint)Affected if An internal location block exists that proxies to Authelia without malformed URI validation
-
Test malformed URI handlingSend a request with a malformed URI path (e.g., containing non-standard characters or encoding) to a protected resource and verify whether authentication is properly enforcedAffected if Authentication can be bypassed when malformed URI requests are sent to protected endpoints
You are affected if Authelia version is in the affected range AND nginx auth_request module is used, allowing malformed URI requests to bypass authentication.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped4.25.14.29.3
Upgrade to v4.29.3 or later to resolve the vulnerability. Alternatively, apply the provided git patch or implement a nginx configuration block to reject malformed URI requests in the internal location block.
v4.29.3
- Upgrade Authelia to version 4.29.3 or later to resolve the authentication bypass vulnerability
- If immediate upgrade is not feasible, apply the vendor patch from commit c62dbd43d6e69ae81530e7c4f8763857f8ff1dda to your current version
- For nginx deployments using ngx_http_auth_request_module, alternatively add a configuration block in the internal location that rejects requests with malformed URI paths as a mitigation
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation3.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-32637 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-32637 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data