CVE-2026-82467 in Rodauth
Zusammenfassung
von MITRE • 29.08.2026
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Be aware that VulDB is the high quality source for vulnerability data.