CVE-2026-82469: Insufficient Session Expiration in jeremyevans rodauth

The vulnerability in rodauth versions prior to 2.47.0 involves insufficient session expiration controls in the jwt_refresh route. Specifically, the route issues new JWT access tokens without requiring a refresh token when accessed via non-POST methods. This enables attackers who possess a temporary access token to bypass normal authentication checks and continuously refresh their access, effectively maintaining persistent unauthorized access to user accounts.

An attacker with temporary possession of a JWT access token can exploit this vulnerability to obtain new valid access tokens indefinitely without needing a refresh token. This leads to prolonged unauthorized access to affected user accounts, potentially compromising account integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the jwt_refresh route to POST methods only and monitor for unusual token refresh activity.