CVE-2026-82466: Rodauth before 2.46.0 Authentication Bypass via webauthn_login
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be logged in as a user. The vulnerable webauthn_login route can then be used to authenticate as another account without requiring privileges on the target account.
Which deployments are affected?
Rodauth versions before 2.46.0 are affected where the webauthn_login route is available. The provided information does not establish whether that route is enabled by default.
What should be done to remediate the issue?
Upgrade Rodauth to version 2.46.0 or later. The supplied data does not identify a workaround for installations that cannot be upgraded immediately.