CVE-2026-82468: Cross-Site Request Forgery (CSRF) in jeremyevans rodauth

CVE-2026-82468 describes a CSRF protection bypass in jeremyevans rodauth prior to version 2.47.0. The vulnerability arises because the JSON request content type validation can be circumvented by attackers using content types that include application/json substrings. This bypass allows cross-origin form posts to evade CSRF token checks, enabling attackers to coerce victims into authenticating to attacker-controlled accounts.

An attacker can bypass CSRF protections and force a victim to authenticate to an attacker-controlled account. This could lead to session confusion or unauthorized actions performed under the victim's context. The impact is limited to authentication bypass scenarios and does not include direct code execution or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider additional CSRF mitigations or content type restrictions as interim measures.