External risk intelligence

Rodauth Authentication Bypass via WebAuthn Login.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-82466

Rodauth is an authentication framework designed for web applications. The vulnerability exists in the webauthn_login route, which is a public-facing authentication endpoint by design in normal deployment, making the vulnerable service directly accessible to internet traffic.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an authentication bypass vulnerability in Rodauth, an authentication framework. The issue allows logged-in users to impersonate any other account by exploiting flaws in how user accounts are resolved during login. This could potentially lead to unauthorized access to user data and system functions. The main concern is confirming relevance and exposure.

Authentication bypass allows account impersonation.
Critical authentication flaw could impact user access.
Confirm if your systems use this authentication framework.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication by exploiting a flaw in the webauthn_login route. This vulnerability allows an authenticated user to impersonate any other account by leveraging improper account resolution logic. Instead of correctly validating the credential binding, the system incorrectly falls back to session account identifiers, enabling arbitrary user authentication.

Accessible via network without authentication.
Improper account resolution logic.
Allows impersonation of any account.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any logged-in user to impersonate any other account through the webauthn_login route. This occurs when the system incorrectly falls back to session account identifiers instead of verifying credential bindings during the authentication process.

Account access.
Via improper account resolution logic.
Unauthorized account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in Rodauth's `webauthn_login` route requires immediate attention from application owners and the platform team responsible for authentication services. The first practical step is to inventory all instances of Rodauth, confirm which are exposed externally or handle critical business functions, identify the specific accountable owner for each instance, and then prioritize remediation based on assessed risk and potential business impact.

Application owners should take immediate charge.
Verify external exposure and critical business impact.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Rodauth?

Rodauth is a library that provides authentication features for Ruby-based web applications. It serves as a toolkit for developers to manage common security tasks like account creation, password management, and multi-factor authentication, helping them implement these complex processes more securely within their own software projects.

What does CWE-287 mean for CVE-2026-82466?

CWE-287 refers to improper authentication. In this specific case, it means the software fails to correctly verify the identity of a user during the WebAuthn login process. Instead of checking that a cryptographic credential matches the specific user account being accessed, the system mistakenly relies on existing session information, which allows a user to impersonate others.

How does the authentication bypass occur?

The flaw is triggered when the system's account resolution logic fails to validate the binding between a specific credential and a user. The process incorrectly defaults to using session account identifiers. Notably, this issue specifically involves the webauthn_login route; users attempting to log in through standard password routes or other non-WebAuthn methods do not trigger this specific vulnerability path.

Why is this CVE considered relevant for internet-facing systems?

According to Halo Surface Signal, this vulnerability resides in the webauthn_login route, which is designed to be a public-facing authentication endpoint. Because this service is typically exposed directly to internet traffic to support user logins, there is a higher likelihood that an attacker could reach the vulnerable code path from outside your internal network.

How should I respond to this Rodauth advisory?

Your first step is to identify every application in your environment that uses Rodauth. Once you have an inventory, determine which instances are accessible over the internet or handle sensitive user data. Coordinate with your application teams to verify their current version and prioritize updating to a version that contains the fix to prevent unauthorized account access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.