CVE-2026-82467: Rodauth before 2.47.0 Open Redirect via Return-to Path
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rodauthto a version that resolves this vulnerability.Fixed in 2.47.0 - Configuration
In Rodauth versions before 2.47.0, update the return-to path handling for confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location so protocol-relative paths using leading double slashes (//) are rejected.
Rodauth confirm_password / login_return_to_requested_location / two_factor_auth_return_to_requested_location return-to path validation = Block protocol-relative return-to paths that begin with leading double slashes (//)
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Rodauth before 2.47.0 are affected when they use the confirm_password, login_return_to_requested_location, or two_factor_auth_return_to_requested_location features.
What must an attacker do to exploit this issue?
The attacker must cause a user to follow a crafted return-to path beginning with double slashes. After the user logs in or confirms their password, the browser can resolve that path as a protocol-relative URL and redirect the user to an attacker-controlled site.
Are unauthenticated users directly redirected by this flaw?
No. The described redirect occurs after a user authenticates through login or confirms their password, and exploitation requires user interaction with a crafted path.
What is the remediation?
Upgrade Rodauth to version 2.47.0 or later. The issue is fixed by validating protocol-relative return-to paths.