Rodauth
Monthly
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. Reported by VulnCheck; a vendor patch (2.46.0) exists and the fix commit ships a reproduction test, but there is no public exploit identified and no active exploitation on record.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
Authentication bypass in Rodauth (the Ruby authentication framework by Jeremy Evans, jeremyevans:rodauth) before 2.46.0 lets an already-authenticated user complete WebAuthn login as an arbitrary victim account. The webauthn_login route resolves the target account from the session identifier rather than binding the presented WebAuthn credential to its owning account, so a logged-in attacker can pivot into any other account, yielding full account takeover. Reported by VulnCheck; a vendor patch (2.46.0) exists and the fix commit ships a reproduction test, but there is no public exploit identified and no active exploitation on record.