CVE-2026-82470 Rodauth Time-Based One-Time Password Reuse Vulnerability. Affected product: Rodauth versions before 2.47.0. Vulnerability class: Time-based one-time password reuse. Likely operational impact: Attackers can bypass the second authentication factor by reusing a valid TOTP code during the drift window. Source-confidence limits: Official CVE Program record and NIST NVD detail page confirm vulner [truncated]
CVE-2026-82469 is an authentication bypass vulnerability in Rodauth before 2.47.0. The jwt_refresh route can issue new JWT access tokens without requiring a refresh token, allowing attackers to obtain indefinite account access with temporary token possession. Organizations should review their Rodauth deployments and plan for upgrades or mitigations. This vulnerability has a CVSS score of 5.1 and is consid [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-29T17:17:59.213Z and has not been modified since then. Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to byp [truncated]
Rodauth before 2.47.0 is vulnerable to open redirect attacks due to improper validation of protocol-relative return-to paths in certain features. This vulnerability allows attackers to craft malicious URLs that can redirect authenticated users to attacker-controlled sites after login or password confirmation. The issue affects Rodauth versions prior to 2.47.0 and can be mitigated by upgrading to the lates [truncated]
CVE-2026-82466 is a critical authentication bypass vulnerability in Rodauth before version 2.46.0, affecting the webauthn_login route. The vulnerability allows attackers to authenticate as any user due to improper account resolution logic. This issue impacts Rodauth deployments that have not been upgraded to version 2.46.0 or later. The vulnerability's technical details indicate that an attacker can explo [truncated]
