Comment on Is Authelia enough without fail2ban or crowdsec?

frongt@lemmy.zip ⁨1⁩ ⁨week⁩ ago

• Arda@piefed.social ⁨1⁩ ⁨week⁩ ago

  sure but if there would be an exploit in authelia would f2b even help, isnt the way it works that it blocks mostly spam and known bad traffic? If its already known by filterlists i feel its safe to assume its patched in authelia

  original

  • IanTwenty@piefed.social ⁨1⁩ ⁨week⁩ ago

    Say that new authelia exploit looks like one fail2ban already recognises or relies on timing/brute-force then you’re covered even before a patch is available.

    Here’s a real authelia vuln:

    https://app.opencve.io/cve/CVE-2026-47203

    allowing an attacker to circumvent login throttling or account lockouts by simply altering the case of their credentials.

    I think fail2ban would help protect authelia here?

    original