Authentication Bypass in Rodauth via JWT Refresh Route

Executive Summary

Rodauth before 2.47.0 has an authentication bypass in the jwt_refresh route. Normally this route requires a refresh token to issue new JWT access tokens, but attackers can present just an access token via non-POST methods to obtain a new valid access token. This allows indefinite account access even with temporary token possession.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Rodauth version is below 2.47.0. Run: gem list rodauth. If the version is older, the system is vulnerable. Additionally, inspect network traffic for non-POST requests to the jwt_refresh route that return new access tokens in the Authorization header.

Useful 0 Not Useful 0

Impact Analysis

Attackers could gain indefinite access to accounts by exploiting this flaw. Even if they only temporarily obtain a valid access token, they can use the jwt_refresh route to generate new tokens without needing a refresh token. This could lead to unauthorized data access or actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized token generation risks exposing personal or protected health information, potentially resulting in regulatory penalties or breaches of confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Rodauth to version 2.47.0 or later immediately. If upgrading is not possible, modify the set_jwt_token method to remove the Authorization header for non-POST requests or requests not accepting JSON. Alternatively, set allow_refresh_with_expired_jwt_access_token? to false if currently enabled.

Useful 0 Not Useful 0