CVE-2026-82466criticalCWE-287

CVE-2026-82466: critical vulnerability in jeremyevans rodauth

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Published · Updated

Follow this CVE+ Monitor rodauth+ Monitor ruby-rodauth

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.6%
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
jeremyevans · rodauth
Related CVEs — jeremyevans rodauth

In the same product, most dangerous first.

CVE-2026-82470MEDIUMRodauth before 2.47.0 TOTP Code Reuse via Drift WindowEPSS 0.4%CVE-2026-82469MEDIUMRodauth before 2.47.0 Authentication Bypass via jwt_refreshEPSS 0.4%CVE-2026-82467MEDIUMRodauth before 2.47.0 Open Redirect via Return-to PathEPSS 0.3%CVE-2026-82468MEDIUMRodauth before 2.47.0 CSRF Protection Bypass via Content-TypeEPSS 0.2%