Authentication Bypass in Rodauth by Jeremy Evans

CVE-2026-82469

What is CVE-2026-82469?

Rodauth prior to version 2.47.0 is vulnerable to an authentication bypass issue in the jwt_refresh route. This flaw allows attackers to exploit the refresh route, issuing new JWT access tokens without validating a refresh token. By utilizing non-POST methods to present an access token, an attacker can obtain valid tokens, leading to potential endless account access as long as temporary tokens are retained. Proper remediation involves upgrading to version 2.47.0 or later.

References