Authelia is a forward-auth companion. It sits in front of an application, asks for a second factor, and then lets a reverse proxy decide whether the request continues. If that description is accurate, then an Authelia instance answering to the public internet is a deployment that has been wired in a way the product does not assume.

The numbers

On 23 October 2026, ZoomEye returned 11,813 matches for title="Authelia" and 1,736 matches for title="Authelia" && port="9091". The application fingerprint query, app="Authelia", returned zero.
The zero is informative rather than empty. It means the scanner did not find a response pattern it attributes to the product under that field. Authelia's own documentation, including its Traefik integration guide, shows the companion listening on 9091 for the forward-auth endpoint, with the user portal served through the proxied application. A deployment that exposes 9091 directly is a deployment where the authentication portal is addressable without the application it is meant to protect.

What the 1,736 hosts are

A host with an Authelia title on port 9091 is presenting the product's own interface on the companion port. That is a configuration that works, and it is not the configuration the documentation recommends. The portal is designed to be reached through the proxy so that session cookies are scoped to the protected domain, the TLS certificate matches the name users type, and the proxy enforces the policy on every request.
Direct access to the companion has consequences that are easy to miss. The cookie domain changes, so a session established on the direct port is not necessarily the session the proxy trusts. CORS behaviour changes, because the origin is different. And the portal becomes a separate attack surface that the proxy's own hardening rules never see.
The 11,813 title matches include all of that plus documentation, project pages, and screenshots. Treat the larger number as a string population. Treat 1,736 as a specific configuration observation.

A defence-in-depth product that needs its own defence in depth

Authelia's value is that it centralises the decision to allow a request. A deployment that exposes the decision endpoint to the internet without the proxy in front has not weakened that decision, but it has widened the path to it. Password spraying against the login form is now possible from anywhere rather than only through the application the proxy protects. Registration and reset flows, if enabled, are reachable in the same way.
The controls that matter are unglamorous. Put the companion behind the same proxy that consumes it. Restrict its listener to the proxy's address at the network layer rather than in the proxy configuration alone. Disable the password reset and registration endpoints unless they are actively used, because an unused self-service flow is an unmonitored login path.

What an external count cannot show

None of these queries reveals a version or a policy. Authelia has had security-relevant advisories in its history, and the counts say nothing about whether a given host is patched. The port observation is a proxy for configuration maturity, not for vulnerability.
The honest use of the number is to answer a question about your own estate. Do you have Authelia instances, and are any of them reachable on their companion port from outside the proxy? A count of 1,736 in a global scan is a reason to check, not a finding about any specific host.

The wider pattern

Reverse-proxy authentication companions are a category where the security architecture and the deployment convenience point in opposite directions. The architecture wants the companion to be invisible. The convenience of a directly reachable portal on a predictable port makes a quick deployment possible, and quick deployments are what a global scan finds.
Authelia's 11,813 titles and 1,736 port-constrained matches describe that tension in numbers. The absence of an application fingerprint completes the picture: this is a product whose public footprint is measured almost entirely through a string, and strings are what naive inventories report.

References

  • Authelia documentation, Traefik integration, https://www.authelia.com/integration/proxies/traefik/

  • Authelia project repository, https://github.com/authelia/authelia

  • ZoomEye AI query results collected 23 October 2026 for title="Authelia", title="Authelia" && port="9091", and app="Authelia", sub-type all