CVE-2026-82469: Rodauth before 2.47.0 Authentication Bypass via jwt_refresh
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rodauthto a version that resolves this vulnerability.Fixed in 2.47.0 - Compensating control
Apply a mitigation on the jwt_refresh route to ensure access tokens are not accepted via non-POST methods (only allow POST on the jwt_refresh endpoint) until the Rodauth upgrade to 2.47.0 is completed.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Rodauth before 2.47.0 are affected if they expose the jwt_refresh route. The issue applies when an attacker can send a non-POST request to that route with an access token.
What does an attacker need to exploit this issue?
An attacker needs possession of a valid JWT access token for the target account. They can use that access token on the jwt_refresh route via a non-POST method; no refresh token is required.
What is the practical impact of successful exploitation?
An attacker can obtain a new valid JWT access token from a temporarily possessed access token. This can allow indefinite continued access to the affected account by repeatedly refreshing access tokens.
What should be done if an immediate upgrade is not possible?
Restrict the jwt_refresh route so that non-POST methods cannot be used to issue tokens. Because an attacker needs a valid access token, treat suspected token exposure as account exposure and prevent use of affected refresh requests.