CVE-2026-82467

Rodauth before 2.47.0 Open Redirect via Return-to Path

4.9 MediumFix available

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: None

Exploit likelihood

0.33%Up 0.1 points since Aug 30, 2026

What each source reports

CVE List Score used 4.9

Rodauth before 2.47.0 Open Redirect via Return-to Path

Record: CVE-2026-82467
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

EUVDEUVD-2026-68124 4.9

Record: EUVD-2026-68124
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mg2m-xp22-59vc 4.9

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password,...

Record: GHSA-mg2m-xp22-59vc
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

NVD 4.9

Record: CVE-2026-82467
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

OSV 4.9

Rodauth before 2.47.0 Open Redirect via Return-to Path

Record: CVE-2026-82467
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-601
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-82467 4.9

Record: DEBIAN-CVE-2026-82467
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-82467 4.9

Record: UBUNTU-CVE-2026-82467
CVSS 4.0: 4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

jeremyevans rodauth

Affected packages

Affected packages
Package	Affected	Fixed
`ruby-rodauth` Debian:14	before 2.47.0-1, plus listed versions 2.42.0-12.42.0-22.43.0-12.44.0-12.45.0-12.46.0-1	2.47.0-1
`ruby-rodauth` Ubuntu:26.10	All versions, plus listed versions 2.43.0-12.44.0-12.45.0-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-82467 is a medium vulnerability (CVSS 4.9) in Jeremyevans Rodauth, published August 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in ruby-rodauth 2.47.0-1.

References

Show 4 moreShow less