Authentication Bypass in Rodauth via WebAuthn Login Route

Executive Summary

CVE-2026-82466 is an authentication bypass in Rodauth versions before 2.46.0. The flaw exists in the webauthn_login route, where logged-in users can impersonate any other account. The issue stems from improper account resolution logic that incorrectly falls back to session account identifiers instead of validating credential binding.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Rodauth version is below 2.46.0. Run: gem list rodauth. If the version is older, the system is vulnerable. Additionally, review webauthn_login route configurations for improper implementation of the already_logged_in method.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain unauthorized access to other users' accounts without proper authentication. This allows impersonation, data theft, or unauthorized actions on behalf of other users. The vulnerability requires network access but no privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient authentication controls, potentially leading to data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Rodauth to version 2.46.0 or later immediately. If upgrading is not possible, implement the already_logged_in configuration method to halt or redirect logged-in users accessing the webauthn login page. Ensure proper validation of credential binding in the webauthn_login route.

Useful 0 Not Useful 0