THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82466 (HIGH 8.7) — Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of va

[NVD] CVE-2026-82466 (HIGH 8.7) — Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of va

mednvdPublished 2026-08-29

CVE-2026-82466 CVSS: 8.7 HIGH Published: 2026-08-29T17:17:58.910

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentica

Indicators of compromise

CVE-2026-82466cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82466