cve.bz

CVE-2026-82466

9.4 criticalEPSS 0.6%

Critical (9.4). EPSS 0.6% chance of exploitation in the next 30 days.

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

Severity

CVSS 4.0

9.4 critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

8.7 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON