Increased password guessing via identifier-specific regulation keys

Improper login-attempt restriction in Authelia before 4.38.19 allows remote authenticated users to double password guesses. The first-factor handler keyed regulation checks and attempt records by the submitted username or email instead of resolving both forms to the account username. Exploitation requires email login, weak passwords, and reduced regulation protection; default bans and multifactor authentication substantially limit account compromise.