Rodauth Protocol-Relative URL Redirect Vulnerability

Executive Summary

CVE-2026-82467 is an open redirect vulnerability in the Rodauth authentication library for Ruby applications. It occurs because Rodauth versions before 2.47.0 fail to validate protocol-relative return-to paths in specific features like confirm_password and login_return_to_requested_location. Attackers exploit this by crafting paths with leading double slashes, which browsers interpret as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Rodauth version is below 2.47.0. Run: gem list rodauth. If the version is older, the system is vulnerable. Also review application code for enabled features like confirm_password, login_return_to_requested_location?, or two_factor_auth_return_to_requested_location?.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables phishing attacks by tricking users into visiting malicious sites after authentication. While it does not grant direct access to the application, attackers can use it to redirect users to fake login pages or other deceptive sites, potentially stealing credentials or sensitive data. Users relying on affected features are at risk if they do not update to Rodauth 2.47.0 or later.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables phishing attacks by redirecting authenticated users to attacker-controlled sites after login or password confirmation. While it does not directly expose data, it could facilitate credential theft or unauthorized access, potentially violating GDPR's security requirements (Article 32) and HIPAA's safeguards for protecting patient data (45 CFR 164.308(a)(1)(ii)(B)). Organizations using affected Rodauth versions may face compliance risks if such attacks lead to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Rodauth to version 2.47.0 or later. Run: gem update rodauth. If updating is not possible, disable the affected features: confirm_password, login_return_to_requested_location?, and two_factor_auth_return_to_requested_location? in your application configuration.

Useful 0 Not Useful 0