# SillyTavern has Authentication Bypass via SSO Header Injection

SillyTavern trusts client-supplied Remote-User/X-Authentik-Username headers for SSO login, letting any network client authenticate as admin without a password.

- Payout: Research
- Severity: critical
- Program: SillyTavern
- Found by: kirakira-dev
- Disclosed: 2026-05-12
- CVE: CVE-2026-44649
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gxx6-h3g6-vwjh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-gxx6-h3g6-vwjh
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:critical tech:nodejs technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Node.js web app /login SSO header handling
**Root cause:** headerUserLogin reads Remote-User or X-Authentik-Username via request.get() with no check that the request came from a trusted reverse proxy, so any direct client can set the header. The public /api/users/list endpoint also leaks valid handles needed to match.
**Steps:**
1. POST `{}` to `/api/users/list` to enumerate user handles including admins
2. Send `GET /login` with header `Remote-User: <admin-handle>` and capture the session cookie
3. Fetch `/csrf-token` with the session cookie to obtain a CSRF token
4. POST to `/api/users/admin/get` with `X-CSRF-Token` and the session cookie to act as admin
**How found:** Code review of tryAutoLogin/headerUserLogin in src/users.js noting request.get() cannot distinguish proxy-set from client-set headers, plus noticing /api/users/list is registered before requireLoginMiddleware.
**Exploitation:** Attacker with direct network access to the SillyTavern port enumerates handles via the unauthenticated /api/users/list, injects Remote-User (Authelia) or X-Authentik-Username (Authentik) on /login to get an authenticated session as any user, then uses the CSRF token to call admin APIs. Requires sso.autheliaAuth or sso.authentikAuth enabled.
**Escalation:** Enumerating admin handles first lets the attacker target the highest-privilege account directly.
**Insight:** When a proxy-header SSO scheme is implemented, check whether the app enforces a source-IP allowlist; also check route registration order for public endpoints that leak the exact identifiers (handles) the SSO match requires.