CVE-2026-82467 jeremyevans CVE debrief

Who should care

Users of Rodauth versions before 2.47.0, security teams responsible for authentication and authorization, and developers of applications using Rodauth for authentication should be aware of this vulnerability. They should prioritize inventory checks, compensating controls, and monitoring to mitigate potential risks. Additionally, security teams should review authentication and authorization mechanisms to ensure they are not vulnerable to open redirect attacks.

Technical summary

Rodauth before 2.47.0 is vulnerable to open redirect attacks due to improper validation of protocol-relative return-to paths in certain features. This vulnerability allows attackers to craft malicious URLs that can redirect authenticated users to attacker-controlled sites after login or password confirmation. The issue affects Rodauth versions prior to 2.47.0 and can be mitigated by upgrading to the latest version or implementing compensating controls.

Defensive priority

Authenticated users of Rodauth may be redirected to attacker-controlled sites after login or password confirmation; prioritize inventory checks and compensating controls.

Recommended defensive actions

• Inventory and verify Rodauth version
• Apply vendor remediation when available
• Implement compensating controls and monitoring
• Review authentication and authorization mechanisms
• Verify affected systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation. The vulnerability allows for open redirect attacks, potentially leading to phishing or further malicious activities. Defenders should verify affected systems, review authentication and authorization mechanisms, and implement compensating controls to mitigate potential risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.