Rodauth CVE-2026-82470

Two prerequisites must be satisfied: the attacker must already possess the target account's username and password (the first authentication factor), and must observe or intercept a valid TOTP code submitted during an active authentication session. The Rodauth otp feature must be enabled in the application configuration. The usable replay window equals the configured otp_drift value on each side of the code's generation timestamp. Remote unauthenticated attackers who do not hold prior credentials cannot exploit this vulnerability; exploitation is further bounded by the narrow time window and the need for real-time code observation.

The CVSS 4.0 score of 5.1 with PR:H reflects that exploitation demands the attacker already possess the target account password and then observe or intercept a live TOTP code - preconditions that substantially limit opportunistic mass exploitation and make this a targeted-threat concern rather than a commodity risk. No EPSS score was included in the source data, preventing quantitative probability comparison. The CVE is absent from CISA KEV, and no standalone public exploit tool is independently confirmed, though the patch commit's regression test demonstrates the exact attack sequence step by step. Impact is bounded to VC:L and VI:L - account-level access, not system-wide compromise - which aligns with the moderate CVSS score. The practical exploitation window equals the configured otp_drift duration; default or larger drift values extend that window meaningfully. Applications that deploy TOTP specifically to protect high-value accounts should treat this as a priority fix since it directly nullifies the security guarantee of the second factor.

An attacker who has obtained a victim's username and password via phishing or credential stuffing monitors the victim completing a TOTP login - for example through a transparent TLS interception proxy or by physical observation. Within the configured drift window after the code was first used, the attacker submits the same code to establish a parallel authenticated session. The patch commit's regression test with a 90-second drift window demonstrates this exact sequence successfully against unpatched versions.