Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: jeremyevans rodauth 2.47.0 Clear all filters
TI-2026-56864 CVE-2026-82470 · GHSA-frwg-xgr9-44pg

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Priority LOW 23

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00408 Published 2026-08-29 Fixed in 2.47.0 CWE-294
TI-2026-56863 CVE-2026-82469 · GHSA-mhhp-hxcr-939w

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Priority LOW 23

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00408 Published 2026-08-29 Fixed in 2.47.0 CWE-613
TI-2026-56862 CVE-2026-82468 · GHSA-8928-x2p4-43mr

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Priority LOW 22

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation.

CVSS 4.0MEDIUM 4.9 Network No auth User interaction EPSS 0.00181 Published 2026-08-29 Fixed in 2.47.0 CWE-352
TI-2026-56861 CVE-2026-82467 · GHSA-mg2m-xp22-59vc

Rodauth before 2.47.0 Open Redirect via Return-to Path

Priority LOW 22

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features.

CVSS 4.0MEDIUM 4.9 Network No auth User interaction EPSS 0.00332 Published 2026-08-29 Fixed in 2.47.0 CWE-601