CVE-2026-82467
MediumCVSS 4.7Summary
Rodauth before version 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Risk Assessment
The risk involves redirecting users to malicious sites after login, which could lead to credential theft or malware installation.
Recommendation
It is recommended to upgrade Rodauth to version 2.47.0 or later, which includes a fix for return-to path validation.
Other vulnerabilities in Rodauth
See all- CVE-2026-82470Medium
Rodauth before version 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
- CVE-2026-82469Medium
Rodauth before version 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.
- CVE-2026-82468Medium
Rodauth before version 2.47.0 contains a CSRF protection bypass vulnerability in JSON request content type validation. Attackers can craft cross-origin form posts with content types containing 'application/json' substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
- CVE-2026-82466High
Rodauth before version 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Original NVD description (English source)
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.