CVE-2026-82468: Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Rodauth versions before 2.47.0 are affected. Exploitation targets users who can be induced to submit a cross-origin form request to the vulnerable application.
What does an attacker need to exploit the bypass?
The attacker does not need privileges, but must convince a victim to interact with a crafted cross-origin form post. The form uses a content type containing an application/json substring so that CSRF token validation is bypassed.
What is the practical impact of successful exploitation?
An attacker can force a victim to authenticate to an account controlled by the attacker. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.
How can this be remediated?
Upgrade Rodauth to version 2.47.0 or later. The issue is addressed by the referenced upstream commit.