EUVD-2026-68127

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth (a Ruby authentication library) before 2.47.0 contains a TOTP code reuse vulnerability in its otp feature. The root cause is a failure to track the last accepted code timestamp, allowing an attacker who observes a valid time-based one-time password to replay it within the drift window and...

CVE-2026-82469

Rodauth before 2.47.0 contains an authentication bypass in its jwt_refresh route. The route issues new JWT access tokens without requiring a valid refresh token; an attacker who holds a temporary access token can present it via a non-POST method to obtain a new valid token, enabling indefinite ac...

EUVD-2026-68126

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82468

Rodauth versions before 2.47.0 contain a cross-site request forgery (CSRF) protection bypass in the JSON request content type validation. An attacker can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation, forcing victims to aut...

EUVD-2026-68125

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-82467

Rodauth before 2.47.0 is affected by an open redirect vulnerability in its confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. The root cause is a failure to validate protocol-relative return-to paths : an attacker can craft paths begin...

EUVD-2026-68124

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

EUVD-2026-68123

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

CVE-2026-82466

Rodauth versions before 2.46.0 contain an authentication bypass in the webauthn_login route. The root cause is improper account resolution logic that falls back to session account identifiers instead of validating the credential binding, allowing a logged-in user to authenticate as any other acco...