CVE-2026-82466: Improper Authentication in jeremyevans rodauth

CVE-2026-82466 describes an authentication bypass vulnerability in the rodauth library prior to version 2.46.0. The vulnerability exists in the webauthn_login route, where the authentication logic improperly resolves accounts by falling back to session account identifiers instead of validating the credential binding. This allows an attacker who is already logged in to authenticate as any arbitrary user, bypassing normal authentication controls.

An attacker who is logged in can exploit this vulnerability to impersonate any other user account without needing valid credentials for that account. This can lead to unauthorized access to sensitive data and functionality associated with the impersonated accounts. The CVSS 4.0 score of 9.4 indicates a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor the rodauth project for updates and apply any official fixes once available. Until then, consider restricting access or disabling the vulnerable webauthn_login route if feasible.