CVE-2026-44649: SillyTavern: Authentication Bypass via SSO Header Injection

Synopsis

An authentication bypass in SillyTavern, a local UI for interacting with text/image/voice generation models, allows unauthenticated network attackers to log in as any user including administrators. The flaw lives in SSO header handling: SillyTavern trusts Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers without confirming they came from a trusted reverse proxy, so any client that can reach the listening port directly can inject the header and impersonate an account. Exploitation requires that sso.autheliaAuth or sso.authentikAuth is enabled in config.yaml (both default off). A patched-image rebuild at version 1.18.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the SillyTavern HTTP port directly over the network, bypassing any reverse proxy.

• AuthenticationNot required

  No credentials are needed; the injected SSO header itself is treated as proof of identity.

• Victim interactionNot required

  Exploitation is a direct HTTP request from the attacker; no user has to click or visit anything.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free once the port is reachable and SSO is enabled in config.yaml.

Blast Radius

• Authenticates as any chosen account, including administrator, without a password.
• Reads stored chats, prompts, API keys, and any user data managed by the SillyTavern instance.
• Modifies user settings, personas, and server configuration through the impersonated session.
• Can disrupt or take over the service by altering admin-controlled settings and credentials.