Rodauth CVE-2026-82466

Exploitation requires the target application to have the Rodauth webauthn_login feature enabled, and the attacker must be a logged-in user with an active session on that application (any valid account suffices) who has registered their own WebAuthn credential; the attack is then performed against the webauthn_login route to authenticate as an arbitrary victim account. Limiting factors: applications that do not enable webauthn_login are not affected; the attacker needs valid low-privilege authenticated access rather than fully anonymous access (reflected by AT:P in the CVSS 4.0 vector despite its PR:N marking); and no additional user interaction from the victim is required.

This is a genuinely high-priority flaw, not merely a high-CVSS artifact: the impact is authentication bypass leading to arbitrary-account takeover in a security library whose entire purpose is authentication, with High confidentiality and integrity impact in the CVSS 4.0 vector (VC:H/VI:H). Two signals warrant nuance. First, there is tension between the vector and the description: the CVSS 4.0 string lists PR:N (no privileges), yet the description states the attacker must be a 'logged-in user' - the AT:P (attack requirements present) metric appears to capture that session/credential prerequisite, so realistic exploitation requires a valid low-privilege account, not fully anonymous access. Second, there is no CISA KEV listing, no EPSS score supplied, and no independent public exploit; however, the fix commit includes a working spec that reproduces the takeover end-to-end, which materially lowers the bar for weaponization. Because Rodauth guards login for whole applications, any operator running the webauthn_login feature should treat this as urgent and patch immediately rather than wait for exploitation evidence.

An attacker registers a normal account on the target application and enrolls their own WebAuthn authenticator. Leveraging an active session, they drive the webauthn_login route against a victim's login and submit an assertion from their own authenticator; because the account is resolved from the session identifier instead of the credential binding, the flow authenticates them into the victim's account. The vendor's fix commit ships a spec test that reproduces this takeover, so a functional reproduction is publicly available even though no standalone exploit has been reported.