Read the docs

jeremyevans

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

jeremyevans records in CISA KEV

No jeremyevans vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-56860 CVE-2026-82466 · GHSA-qw88-v783-w782

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Priority MEDIUM 41

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00613 Published 2026-08-29 Fixed in 2.46.0 CWE-287
TI-2026-56864 CVE-2026-82470 · GHSA-frwg-xgr9-44pg

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Priority LOW 23

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00408 Published 2026-08-29 Fixed in 2.47.0 CWE-294
TI-2026-56863 CVE-2026-82469 · GHSA-mhhp-hxcr-939w

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Priority LOW 23

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00408 Published 2026-08-29 Fixed in 2.47.0 CWE-613
TI-2026-56862 CVE-2026-82468 · GHSA-8928-x2p4-43mr

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Priority LOW 22

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation.

CVSS 4.0MEDIUM 4.9 Network No auth User interaction EPSS 0.00181 Published 2026-08-29 Fixed in 2.47.0 CWE-352
TI-2026-56861 CVE-2026-82467 · GHSA-mg2m-xp22-59vc

Rodauth before 2.47.0 Open Redirect via Return-to Path

Priority LOW 22

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features.

CVSS 4.0MEDIUM 4.9 Network No auth User interaction EPSS 0.00332 Published 2026-08-29 Fixed in 2.47.0 CWE-601
Open these records in search →