Jeremyevans Rodauth
4 CVEs affecting Jeremyevans Rodauth. Latest disclosed: 2026-08-29. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82470 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Atta… |
CVE-2026-82469 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh to… |
CVE-2026-82468 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cr… |
CVE-2026-82467 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_t… |