Cross-Site Request Forgery Bypass in Rodauth

Executive Summary

CVE-2026-82468 is a CSRF protection bypass in Rodauth versions before 2.47.0. Attackers exploit improper Content-Type header validation by sending cross-origin form posts with Content-Type values containing 'application/json' substring. This bypasses CSRF token checks, forcing victims to authenticate to attacker-controlled accounts without consent.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Rodauth versions before 2.47.0 by inspecting your application's dependency files (e.g., Gemfile.lock for Ruby projects). Use commands like 'gem list rodauth' or 'bundle list | grep rodauth' to verify the installed version. If the version is below 2.47.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to hijack user sessions by bypassing CSRF protections. Victims may unknowingly authenticate to attacker-controlled accounts, leading to unauthorized access to sensitive data or actions. The impact depends on application permissions and SameSite cookie settings.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized account access through CSRF bypass. GDPR requires protecting personal data and preventing unauthorized access, while HIPAA mandates safeguards for sensitive health information. The flaw allows attackers to force victims into attacker-controlled accounts without consent, risking data exposure or unauthorized actions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Rodauth to version 2.47.0 or later. If upgrading is not possible, apply the workaround by configuring the json_request_content_type_regexp setting with an appropriate anchor to enforce strict content-type validation.

Useful 0 Not Useful 0