CVE-2026-82466
HighCVSS 8.7Summary
Rodauth before version 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Risk Assessment
The risk includes the possibility of account takeover, which could lead to unauthorized access to data and actions performed on behalf of other users.
Recommendation
It is recommended to update Rodauth to version 2.46.0 or later, which properly validates WebAuthn credential binding, and to review account resolution logic.
Other vulnerabilities in Rodauth
See all- CVE-2026-82470Medium
Rodauth before version 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
- CVE-2026-82469Medium
Rodauth before version 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.
- CVE-2026-82468Medium
Rodauth before version 2.47.0 contains a CSRF protection bypass vulnerability in JSON request content type validation. Attackers can craft cross-origin form posts with content types containing 'application/json' substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
- CVE-2026-82467Medium
Rodauth before version 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Original NVD description (English source)
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.