CVE-2026-82466

Rodauth versions before 2.46.0 contain an authentication bypass in the webauthn_login route. The root cause is improper account resolution logic that falls back to session account identifiers instead of validating the credential binding, allowing a logged-in user to authenticate as any other acco...