CVE-2026-44649-nvd.nist.gov-Deferred

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-t…

Published:

28 May 2026 at 22:00:00

Alert date:

29 May 2026 at 21:09:42

Source:

nvd.nist.gov

Web Technologies, Identity & Access

SillyTavern versions prior to 1.18.0 contain an authentication bypass vulnerability in SSO implementations. The application accepts Remote-User and X-Authentik-Username HTTP headers for automatic login without validating their origin from trusted reverse proxies. Attackers can inject these headers to authenticate as any user, including administrators, without passwords. The vulnerability only affects installations with sso.autheliaAuth or sso.authentikAuth enabled in config.yaml. Fixed in version 1.18.0.

Technical details

Mitigation steps:

Affected products:

SillyTavern