CVE-2026-82466

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

9.4 CriticalFix available

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.61%Up 0.3 points since Aug 30, 2026

What each source reports

CVE List Score used 9.4

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Record: CVE-2026-82466
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2026-68123 9.4

Record: EUVD-2026-68123
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qw88-v783-w782 9.4

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route...

Record: GHSA-qw88-v783-w782
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

NVD 9.4

Record: CVE-2026-82466
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV 9.4

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Record: CVE-2026-82466
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Weakness: CWE-287
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-82466 9.4

Record: DEBIAN-CVE-2026-82466
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-82466 9.4

Record: UBUNTU-CVE-2026-82466
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

jeremyevans rodauth

Affected packages

Affected packages
Package	Affected	Fixed
`ruby-rodauth` Debian:14	before 2.46.0-1, plus listed versions 2.42.0-12.42.0-22.43.0-12.44.0-12.45.0-1	2.46.0-1
`ruby-rodauth` Ubuntu:26.10	All versions, plus listed versions 2.43.0-12.44.0-12.45.0-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-82466 is a critical vulnerability (CVSS 9.4) in Jeremyevans Rodauth, published August 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in ruby-rodauth 2.46.0-1.

References

Show 4 moreShow less