CVE-2026-82466
CVE-2026-82466
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.003
Weakness classification (CWE)
References
- github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840 (patch)
- github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75 (vendor-advisory)
- github.com/jeremyevans/rodauth (product)
- www.vulncheck.com/advisories/rodauth-before-2.46.0-authentication-bypass-via-we… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82466?
- CVE-2026-82466 is a high-severity vulnerability, classified under Improper Authentication. CVSS score: 8.7/10. Published 2026-08-29.
- How severe is CVE-2026-82466?
- High severity. CVSS v3 base score is 8.7 out of 10.