CVE-2026-82466
CVE-2026-82466
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Vulnerability class: Broken Authentication
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82466?
- CVE-2026-82466 is a high-severity vulnerability, classified under Improper Authentication. CVSS score: 8.7/10. Published 2026-08-29.
- How severe is CVE-2026-82466?
- High severity. CVSS v3 base score is 8.7 out of 10.