Authentication Bypass Vulnerability in Rodauth by Jeremy Evans

CVE-2026-82466

What is CVE-2026-82466?

Rodauth versions prior to 2.46.0 are vulnerable to an authentication bypass through the webauthn_login route. This flaw allows authenticated users to impersonate other accounts due to improper resolution logic, which relies on session account identifiers instead of validating the actual binding of credentials. As a result, an attacker could exploit this vulnerability to gain unauthorized access to arbitrary user accounts.

References