CVE-2026-82468
MediumCVSS 4.7Summary
Rodauth before version 2.47.0 contains a CSRF protection bypass vulnerability in JSON request content type validation. Attackers can craft cross-origin form posts with content types containing 'application/json' substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
Risk Assessment
The risk involves potential session hijacking or forcing users to authenticate to attacker-controlled accounts, which could lead to data theft or unauthorized actions.
Recommendation
It is recommended to immediately upgrade Rodauth to version 2.47.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Rodauth
See all- CVE-2026-82470Medium
Rodauth before version 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
- CVE-2026-82469Medium
Rodauth before version 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.
- CVE-2026-82467Medium
Rodauth before version 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
- CVE-2026-82466High
Rodauth before version 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Original NVD description (English source)
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.