CVE-2026-82470: Authentication Bypass by Capture-replay in jeremyevans rodauth

The vulnerability in rodauth's TOTP feature arises from the failure to track the last accepted TOTP code timestamp, enabling reuse of a previously valid code within the drift window. This capture-replay flaw allows attackers to bypass the second authentication factor by replaying observed valid codes. The issue affects rodauth versions prior to 2.47.0. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker who can observe a valid TOTP code can reuse it during the drift window to bypass the second factor authentication, potentially allowing unauthorized access despite the presence of multi-factor authentication. The impact is limited to the authentication bypass of the second factor and does not indicate privilege escalation or other direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider additional compensating controls or monitoring to detect suspicious authentication attempts involving TOTP reuse.