CVE-2026-44649-nvd.nist.gov-Received

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-t…

Published:

28 May 2026 at 22:00:00

Alert date:

29 May 2026 at 20:03:36

Source:

nvd.nist.gov

Web Technologies, Identity & Access

SillyTavern versions prior to 1.18.0 contain an authentication bypass vulnerability when SSO is configured. The application accepts Remote-User and X-Authentik-Username HTTP headers without validating they originate from trusted reverse proxies. Attackers can inject these headers to authenticate as any user, including administrators, without passwords. The vulnerability is only exploitable when specific SSO configuration options are enabled in config.yaml. This issue has been fixed in version 1.18.0.

Technical details

Mitigation steps:

Affected products:

SillyTavern