Rodauth before 2.46.0 Authentication Bypass via webauthn_login
Priority MEDIUM 41CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00613 49th percentileScored 2026-11-07
Fix Fixed rodauth (jeremyevans): 2.46.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jeremyevans | rodauth | before 2.46.0 | 2.46.0 | Patch available | CNA |
- rodauth Vendorjeremyevans Affected before 2.46.0 Fixed in 2.46.0 Patch available CNA
Remediation
- Fix · CNA rodauth (jeremyevans) Fixed in 2.46.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82466
- 2026-10-03 Alias added: GHSA-qw88-v783-w782
References
Patch 1
More jeremyevans vulnerabilities
- TI-2026-56864 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window CVSS 4.0MEDIUM 5.1
- TI-2026-56863 Rodauth before 2.47.0 Authentication Bypass via jwt_refresh CVSS 4.0MEDIUM 5.1
- TI-2026-56862 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type CVSS 4.0MEDIUM 4.9
- TI-2026-56861 Rodauth before 2.47.0 Open Redirect via Return-to Path CVSS 4.0MEDIUM 4.9
Sources
- CVE-2026-82466 · CVE Program
- CVE-2026-82466 · NVD
- FIRST EPSS
- GHSA-qw88-v783-w782 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences