CVE-2026-44649: SillyTavern authentication bypass through spoofed SSO proxy headers

Summary

SillyTavern versions before 1.18.0 accept the Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers to log users in when SSO is configured, without checking that the headers come from a trusted reverse proxy. Any network client that can reach the SillyTavern port directly can send these headers and authenticate as any user, including administrators, without a password. The flaw is exploitable only when sso.autheliaAuth: true or sso.authentikAuth: true is set in config.yaml, both of which default to false.

Mitigation

Fixed in 1.18.0.

Related items

• MediumCyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian RecordsSimilar attack · The Hacker News
• CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
• LowLost in the comments: Social context as a single‐pass jailbreak and defense on agentic platformsSimilar attack · OpenAlex (peer-reviewed AI security)
• MediumGHSA-hmq2-7hp6-7crh: Banks: User-controlled prompt input can be parsed as privileged chat messagesSimilar attack · GitHub Advisory Database
• HighGHSA-6wjp-v33h-5cvq: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosureSimilar attack · GitHub Advisory Database