CVE-2026-82466
Rodauth before 2.46.0 Authentication Bypass via webauthn_login
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 29, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 29, 2026
Description
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
rodauthjeremyevans |
|
References
- Patch Commitpatch
- GitHub Security Advisory (GHSA-3pvr-v35r-4r75)vendor-advisory
- https://github.com/jeremyevans/rodauthproduct
- VulnCheck Advisory: Rodauth before 2.46.0 Authentication Bypass via webauthn_loginthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.