Authentication bypass via SSO header injection in SillyTavern (CVE-2026-44649)

SillyTavern accepts `Remote-User` (Authelia) and `X-Authentik-Username` (Authentik) HTTP headers to automatically log in users when SSO is configured, but does not validate that these headers originate from a trusted reverse proxy. Any network client that can reach the SillyTavern port directly can inject these headers and authenticate as any user, including administrators, without a password. Combined with an unauthenticated user enumeration endpoint, this enables full account takeover when SSO is enabled. Affected versions: - ≤1.17.0 We recommend updating to: 1.18.0. CVSS 9.8 · our assessment: act_now Reference: https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-gxx6-h3g6-vwjh Details: https://vuln.today/cve/CVE-2026-44649