EUVD-2026-68123
GHSA-qw88-v783-w782
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs a valid low-privilege session and an enrolled WebAuthn credential (PR:L), exploited remotely over the network with low complexity, yielding full account takeover (C:H/I:H); no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
AnalysisAI
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to have the Rodauth webauthn_login feature enabled, and the attacker must be a logged-in user with an active session on that application (any valid account suffices) who has registered their own WebAuthn credential; the attack is then performed against the webauthn_login route to authenticate as an arbitrary victim account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority flaw, not merely a high-CVSS artifact: the impact is authentication bypass leading to arbitrary-account takeover in a security library whose entire purpose is authentication, with High confidentiality and integrity impact in the CVSS 4.0 vector (VC:H/VI:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the rodauth gem to 2.46.0 or later, which corrects the account-resolution logic in the webauthn_login feature (fix commit https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840; advisory https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services using Rodauth and determine which are running versions prior to 2.46.0, prioritizing production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observe
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to by
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative retur
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions und
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today