CVE-2026-82470 is a medium-severity vulnerability in Rodauth before version 2.47.0. The vulnerability is related to the time-based one-time password (TOTP) feature, which fails to track the last accepted code timestamp. This allows attackers to reuse a valid TOTP code during the drift window, potentially bypassing the second authentication factor. Defenders should assess exposure and verify the Rodauth ve [truncated]
CVE-2026-82469 is an authentication bypass vulnerability in Rodauth before version 2.47.0. The vulnerability is located in the jwt_refresh route, which can issue new JWT access tokens without requiring a refresh token when accessed via non-POST methods. This allows attackers to obtain a new valid access token by presenting an access token to the refresh route, potentially enabling indefinite account acces [truncated]
CVE-2026-82468 is a medium-severity vulnerability in Rodauth, a Ruby authentication framework, which allows attackers to bypass cross-site request forgery (CSRF) protection via a crafted JSON request. This vulnerability, tracked as CVE-2026-82468, was publicly disclosed on August 29, 2026, and last modified on September 11, 2026. The vulnerability has a CVSS score of 4.9 and is considered medium severity.
CVE-2026-82467 is a medium-severity vulnerability in Rodauth before version 2.47.0. The issue allows attackers to craft protocol-relative return-to paths, potentially redirecting authenticated users to attacker-controlled sites after login or password confirmation. This vulnerability affects Rodauth installations prior to version 2.47.0, and defenders should assess exposure and prioritize updates. The vul [truncated]
CVE-2026-82466 is an authentication bypass vulnerability in Rodauth before version 2.46.0. The vulnerability exists in the webauthn_login route and allows logged-in users to authenticate as any other account due to improper account resolution logic. This logic falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
