Rodauth EUVD-2026-68125

The target application must have Rodauth's JSON feature explicitly enabled in its Rodauth configuration block (i.e., :json included in the enable list). The victim must visit a page controlled by the attacker that initiates a cross-origin form submission - satisfying the UI:P (passive user interaction) requirement. The attack is limited to browsers that permit cross-origin form POSTs with non-simple content types, which is standard browser behavior. No authentication or account on the target application is required by the attacker. Applications that do not enable the Rodauth JSON feature, or that apply additional CSRF enforcement at the Rack or framework layer independently of Rodauth, are not exploitable via this path.

The CVSS 4.0 score of 4.9 with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N is broadly consistent with the vulnerability's mechanics. The SC:H (subsequent-system confidentiality high) captures the most significant real-world impact: a login CSRF attack lets an attacker observe everything the victim does while authenticated to the attacker's controlled account, potentially exposing sensitive data entered by the victim. The UI:P and AT:P constraints are meaningful risk limiters - exploitation requires the victim to visit a malicious page and actively initiate a browser action, reducing automatable, opportunistic exploitation. No CISA KEV listing and no EPSS data are available, and no public exploit tooling has been identified, so the current threat posture is best characterized as theoretical-but-straightforward. The attack is not complex once the malicious page is constructed, and the absence of any privilege requirement (PR:N) means any unauthenticated user capable of social-engineering a victim has a viable path. Applications using Rodauth's JSON feature that handle sensitive user data should treat this as a meaningful priority despite the moderate score, since the impact to an individual victim can be severe even if mass exploitation is unlikely.

An attacker constructs a malicious web page that auto-submits an HTML form POST to the target application's Rodauth login endpoint, setting the form's content type to 'application/x-www-form-urlencoded; application/json' via JavaScript or a crafted enctype attribute. The victim's browser submits the form cross-origin, and Rodauth's unanchored regex matches the 'application/json' substring in the content type, bypassing CSRF token validation and logging the victim into an attacker-controlled account. The attacker can then observe sensitive data entered by the victim while they believe they are operating under their own session.