jeremyevans Rodauth up to 2.46.x redirect

Summaryinfo

A vulnerability identified as problematic has been detected in jeremyevans Rodauth up to 2.46.x. This issue affects some unknown processing. The manipulation leads to redirect. This vulnerability is traded as CVE-2026-82467. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in jeremyevans Rodauth up to 2.46.x and classified as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-82467 since 08/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 341572 (Linux Distros Unpatched Vulnerability : CVE-2026-82467), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.47.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (341572) and EUVD (EUVD-2026-68124). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• jeremyevans

Name

• Rodauth

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46

Website

• Product: https://github.com/jeremyevans/rodauth/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion