CVE-2026-82467: URL Redirection to Untrusted Site ('Open Redirect') in jeremyevans rodauth

Rodauth before version 2.47.0 does not validate protocol-relative return-to paths in the confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. This allows attackers to create return-to paths starting with double slashes, which browsers interpret as protocol-relative URLs. As a result, authenticated users can be redirected to malicious external sites after completing login or password confirmation processes.

The vulnerability enables an attacker to redirect authenticated users to attacker-controlled websites after login or password confirmation. This could facilitate phishing or other social engineering attacks by leveraging the trust users place in the legitimate site. There is no indication of direct code execution or data compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the jeremyevans rodauth project for updates addressing this issue. Until a fix is available, avoid using untrusted or user-controllable return-to URLs in the affected features.