CVE-2026-82470
Received Received - Intake

Time-Based OTP Reuse in Rodauth

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: VulnCheck

Description
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-82470
EUVD
EUVD-2026-68127

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rodauth rodauth to 2.47.0 (exc)
jeremyevans rodauth to 2.47.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Rodauth before 2.47.0 has a vulnerability where time-based one-time passwords (TOTP) can be reused within a drift window. The system fails to track the last accepted code's timestamp, allowing attackers who observe a valid TOTP code to replay it during the drift period and bypass the second authentication factor.

Detection Guidance

To detect this vulnerability, check if your Rodauth version is below 2.47.0. Run: gem list rodauth. If the version is less than 2.47.0, the system is vulnerable. Additionally, verify if the OTP feature is enabled with default drift settings by inspecting Rodauth configuration files for otp_drift settings.

Impact Analysis

If you use Rodauth versions before 2.47.0 with the OTP feature enabled and default drift settings, an attacker could bypass multi-factor authentication by replaying a captured valid TOTP code within the 30-second drift window. This requires the attacker to have access to the code during that window.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by weakening authentication security. GDPR requires strong security measures for protecting personal data, while HIPAA mandates secure access controls for protected health information. The TOTP code reuse flaw may allow unauthorized access, violating these requirements.

Mitigation Strategies

Upgrade Rodauth to version 2.47.0 or later immediately. If upgrading is not possible, disable OTP drift by setting otp_drift nil in the configuration. Ensure no valid TOTP codes are exposed during the drift window to prevent replay attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart